OESA-2026-4724: rubygem-crass security update
Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec. Security Fix(es):
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.8-1.oe2403sp3 - Upgrade
Upgrade
rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.8 - Configuration
Enable the :preserve_comments option; preserving comments avoids the recursive parsing path.
Crass :preserve_comments = enabled
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which applications are most exposed to the CSS parsing discrepancy?
Applications that sanitize untrusted CSS with Crass and then reserialize it are exposed if they do not reject malformed URL tokens. CSS that Crass keeps inside such a token may be interpreted by browsers as live CSS.
What can an attacker achieve through the affected CSS handling?
The issue can enable UI redress, external resource loading, or CSS-based data exfiltration through sanitized CSS. It does not enable script execution in modern browsers.
How can I determine whether my deployment is affected?
Deployments using Crass versions before 1.0.8 are affected by the bad-URL parsing issue. Deployments using versions before 1.0.7 are also affected by deeply nested attacker-controlled CSS blocks or functions that can cause a Ruby SystemStackError or excessive memory use.
What should be done if the CSS sanitizer cannot be updated immediately?
Reject malformed bad URL tokens rather than parsing and reserializing them. This prevents declarations, style rules, or at-rules retained inside a bad URL token from being emitted as CSS.