Denial of Service Vulnerability in Crass Ruby CSS Parser

CVE-2026-61847

What is CVE-2026-61847?

The Crass Ruby CSS parser, prior to version 1.0.7, has a vulnerability that allows an attacker to cause a denial of service. This occurs when a specially crafted stylesheet containing numerous adjacent comments is processed without the ':preserve_comments' option activated. The lack of this option leads the parser to consume excessive stack space through recursive token handling. As a result, a SystemStackError may be triggered, causing the parsing application to become unresponsive. The vulnerability is mitigated in version 1.0.7 by enabling comment preservation.

References