OESA-2026-4726: rubygem-crass security update
Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec. Security Fix(es):
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.8-1.oe2403sp1 - Upgrade
Upgrade
rubygem-crassto a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are most exposed to the CSS parsing issue?
Applications that accept untrusted CSS, parse it with Crass, and reserialize it without rejecting bad URL tokens are exposed. The resulting CSS can retain declarations, style rules, or at-rules that browsers treat as live CSS.
What could an attacker do with the retained CSS content?
An attacker could use the retained CSS for UI redress, external resource loading, or CSS-based data exfiltration. The issue does not enable script execution in modern browsers.
What input is required to trigger the denial-of-service issue?
An attacker needs to provide a CSS value containing deeply nested simple blocks or functions. Before version 1.0.7, this can cause Ruby to raise SystemStackError or consume excessive memory.
How can I determine whether the installed package is affected?
Crass versions before 1.0.8 are affected by the bad-URL parsing issue, CVE-2026-116695. Versions before 1.0.7 are affected by the unbounded recursive parsing issue, CVE-2026-61846.
What can be done before an update is available?
For the bad-URL issue, reject untrusted CSS containing bad URL tokens rather than reserializing it. For the recursion issue, limit or reject attacker-controlled CSS with deeply nested blocks or functions.