UBUNTU-CVE-2026-61847: Medium severity ubuntu/ruby-crass vulnerability
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications that use ruby-crass to parse attacker-provided or otherwise untrusted CSS are exposed, particularly when they use the default configuration that does not preserve comments. The impact is a parser failure with SystemStackError, which can deny service to the parsing application.
What input is required to trigger the issue?
An attacker needs to provide a stylesheet with a very large number of adjacent CSS comments. No privileges or user interaction are required according to the supplied severity vector.
Are default configurations affected?
Yes. The vulnerable recursive comment-handling path is used when :preserve_comments is not enabled, and that is the default behavior.
What can be done if upgrading is not immediately possible?
Enable the :preserve_comments option when parsing CSS to avoid the recursive path. Longer term, update ruby-crass to version 1.0.7, which fixes the issue.
How can I determine whether an application is affected?
Check whether it uses ruby-crass before version 1.0.7 and parses untrusted stylesheets without enabling :preserve_comments. Such an application may fail with SystemStackError when processing CSS containing many adjacent comments.