Remote Code Execution Vulnerability in Crass Ruby CSS Parser

CVE-2026-61845

What is CVE-2026-61845?

The Crass Ruby CSS parser, which adheres to the CSS Syntax Level 3 specification, before version 1.0.7, is susceptible to a resource exhaustion vulnerability. This occurs when the parser processes CSS scientific notation number values that allow unbounded exponentiation, potentially leading to excessive CPU and memory usage during parsing. Attackers can exploit this issue by supplying specifically crafted CSS strings, which may cause applications utilizing Crass to experience significant performance degradation or crashes. The vulnerability has been addressed in the latest version, 1.0.7.

References