GHSA-6jxj-px6v-747w: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Impact
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.
Patches
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
Workarounds
Add SystemStackError handling around Crass calls in your application. Buy more RAM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Compensating control
Add SystemStackError handling around Crass calls in the application.
- Compensating control
Increase available RAM to mitigate excessive memory usage.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications that use Crass to parse attacker-controlled CSS values are exposed. An attacker can send deeply nested CSS blocks or functions that cause stack exhaustion or excessive memory consumption.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the provided vector. Exploitation requires an attacker to be able to supply a crafted CSS value to a code path that Crass parses.
Are default configurations affected?
Versions before Crass 1.0.7 do not have the depth guard described in the advisory. Crass 1.0.7 adds a configurable depth limit with a conservative default.
What can be done if upgrading is not immediately possible?
Add SystemStackError handling around calls to Crass. This can handle stack-overflow failures, though the advisory also notes that crafted input may cause excessive memory usage.