CVE-2026-61846: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Impact
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.
Patches
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
Workarounds
Add SystemStackError handling around Crass calls in your application. Buy more RAM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Compensating control
Add SystemStackError handling around Crass calls in the application.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the Crass Ruby gem are exposed when they parse attacker-controlled CSS values. An unauthenticated remote attacker can supply deeply nested CSS blocks or functions to trigger the condition.
What is required to exploit the vulnerability?
The attacker needs to provide a CSS value with many deeply nested simple blocks or functions. No authentication or user interaction is required, but exploitation depends on the application passing attacker-controlled CSS to Crass.
Are default deployments affected?
Versions before Crass 1.0.7 do not have the depth guard described in the advisory. Crass 1.0.7 adds a configurable depth limit with a conservative default.
What can be done if upgrading is not immediately possible?
Add SystemStackError handling around calls to Crass to prevent an unhandled stack exhaustion error. The advisory also notes that deeply nested input can consume excessive memory, so this handling does not eliminate the memory-usage risk.