UBUNTU-CVE-2026-61845: High severity ubuntu/ruby-crass vulnerability
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
crassto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications are exposed if they use Crass to parse CSS strings supplied or controlled by an attacker. The affected Ubuntu package is ruby-crass, and versions prior to 1.0.7 are vulnerable.
What does an attacker need to exploit it?
An attacker needs a path to provide CSS input that the application passes to Crass for parsing. No authentication or user interaction is indicated by the supplied severity vector.
What is the impact of successful exploitation?
A tiny CSS input using scientific-notation numeric values can cause disproportionate CPU and memory consumption during parsing. This can potentially crash the affected application, resulting in a denial of service.
What should be done if an update cannot be applied immediately?
Avoid parsing attacker-controlled CSS with Crass until the package can be updated. Where untrusted CSS must be accepted, restricting or rejecting scientific-notation number values can reduce exposure.
How can I determine whether an application is affected?
Check whether the application depends on ruby-crass or Crass and parses untrusted CSS input. If the Crass version is earlier than 1.0.7, it is affected.