UBUNTU-CVE-2026-61846: Medium severity ubuntu/ruby-crass vulnerability
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using ruby-crass before version 1.0.7 to parse attacker-controlled CSS values are exposed. An attacker can supply deeply nested CSS blocks or functions to trigger excessive recursion or memory use.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied severity vector. Exploitation requires the attacker to be able to provide CSS that the affected application parses.
What is the impact of a successful attack?
Parsing deeply nested input can cause Ruby to raise SystemStackError due to stack exhaustion, or consume excessive memory. The supplied vector indicates availability impact for both the vulnerable component and a subsequent system.
What version fixes the issue?
Version 1.0.7 fixes the issue by adding a configurable parsing-depth limit with a conservative default.