Ruby CSS Parser Vulnerability in Crass Affecting Developers

CVE-2026-61846

What is CVE-2026-61846?

The Crass Ruby CSS parser, compliant with CSS Syntax Level 3, is susceptible to a vulnerability due to its insufficient handling of recursively parsed CSS simple blocks and functions. An attacker can exploit this flaw by providing a specially crafted CSS value that includes deeply nested blocks or functions, leading the parser to recurse extensively. This may result in a 'SystemStackError' or cause significant memory consumption, potentially leading to application crashes. This issue has been addressed in version 1.0.7, which introduces a configurable depth limit.

References