CVE-2026-61848: Crass: Non-ASCII characters cause superlinear CPU consumption
Impact
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
Patches
This is fixed in Crass 1.0.7.
Workarounds
Avoid passing non-ASCII input to Crass. Or cultivate patience.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Compensating control
Avoid passing non-ASCII input to Crass.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications that use Crass to parse attacker-controlled input containing many non-ASCII characters are exposed to excessive CPU consumption. This can potentially result in denial of service.
What does an attacker need to exploit it?
An attacker needs to cause Crass to parse input containing a large number of non-ASCII characters. No privileges or user interaction are indicated by the supplied severity vector.
Is there a fixed version available?
Yes. The issue is fixed in Crass 1.0.7.
What can be done if upgrading is not immediately possible?
Avoid passing non-ASCII input to Crass. This reduces exposure to the inefficient multi-byte character position tracking described in the advisory.