Ruby CSS Parser Vulnerability in Crass Affects Performance
CVE-2026-61848

6.3MEDIUM

Key Information:

Vendor

Rgrove

Status
Crass
Vendor
CVE Published:
30 October 2026

What is CVE-2026-61848?

Crass, a Ruby CSS parser adhering to the CSS Syntax Level 3 specification, has a vulnerability that arises from inefficiencies in parsing CSS input containing non-ASCII characters. Before the release of version 1.0.7, this flaw could be exploited by attackers using specially crafted CSS inputs with numerous non-ASCII characters, leading to excessive CPU consumption and a potential denial of service. The issue has been remediated in version 1.0.7, ensuring improved performance and security.

Affected Version(s)

crass < 1.0.7

References

https://github.com/rgrove/crass/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/rgrove/crass/releases/tag/v1.0.7
x_refsource_MISC
http://github.com/rgrove/crass/commit/da29664648bf80a97a6...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.