OESA-2026-4725: rubygem-crass security update
Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec. Security Fix(es):
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.8-1.oe2203sp4 - Upgrade
Upgrade
rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are most exposed to the parsing discrepancy?
Applications that accept untrusted CSS, parse it with Crass, and reserialize it as a sanitizer output are exposed if they do not reject malformed URL tokens. The resulting CSS can support UI redress, external resource loading, or CSS-based data exfiltration.
What must an attacker be able to provide to trigger the denial-of-service issue?
The attacker needs to control a CSS value containing deeply nested simple blocks or functions. Processing that value can cause Ruby to raise SystemStackError or consume excessive memory.
Does the malformed-URL issue permit JavaScript execution?
No. The advisory states that this issue does not enable script execution in modern browsers.
How can I determine whether an installed Crass version is affected?
Versions earlier than 1.0.8 are affected by the malformed-URL parsing issue. Versions earlier than 1.0.7 are affected by the unbounded recursive parsing issue.