GHSA-6wmf-3r64-vcwv: Rubygems/crass vulnerability
Published Oct 20, 2026
·Updated
Impact
Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.
Patches
This is fixed in Crass 1.0.7.
Related
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
Affected Software
1 affected componentFixes available
rubygems/crass<1.0.7
1.0.7
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Oct 20, 2026
Advisory Published
via GitHub·02:32 PM
Data Sourced
via GitHub·02:32 PM
DescriptionWeaknessAffected Software