UBUNTU-CVE-2026-61848: Medium severity ubuntu/ruby-crass vulnerability
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using ruby-crass before version 1.0.7 are exposed when they parse attacker-controlled CSS. The issue is relevant where an unauthenticated remote party can supply CSS content to the application.
What does an attacker need to exploit it?
An attacker needs to provide CSS input containing many non-ASCII, multi-byte characters. No authentication or user interaction is required, but the vulnerable parser must process the supplied input.
How can I remediate the issue?
Update Crass to version 1.0.7 or later. That version fixes the superlinear parsing behavior.
What can be done if an update cannot be applied immediately?
Avoid parsing untrusted CSS where possible, and restrict or reject CSS inputs with large numbers of non-ASCII characters. Limiting the size of submitted CSS can also reduce exposure to excessive CPU consumption.