CVE-2026-61847: Crass: A large number of adjacent CSS comments can trigger a SystemStackError
Impact
When the :preservecomments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
Workarounds
Set the :preservecomments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Set the :preserve_comments option to true if preserving CSS comments is acceptable for the use case.
Crass :preserve_comments = true
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that parse attacker-controlled CSS with Crass are exposed when comment preservation is disabled. This is the default behavior because the :preserve_comments option is not enabled by default.
What does an attacker need to provide?
An attacker needs to supply a stylesheet containing a very large number of adjacent CSS comments. No authentication or user interaction is required according to the supplied severity vector.
What can be done if upgrading is not immediately possible?
Set the :preserve_comments option to true, if preserving comments is acceptable for the application. With comments preserved, the recursive comment-discarding behavior does not occur.
Which version fixes the problem?
Crass 1.0.7 fixes the issue by no longer using recursion when discarding comments.