Crass Ruby Gem Vulnerable to CPU Exhaustion via CSS Parsing Flaw
A high-severity flaw in the Crass gem allows attackers to crash applications by exploiting unbounded exponentiation in CSS parsing.
Key points
- CVE-2026-61845 affects Crass versions prior to 1.0.7.
- The flaw causes disproportionate CPU and memory usage during parsing.
- A fix is available in Crass version 1.0.7.
The Crass Ruby gem, a tool used for parsing CSS, contains a high-severity vulnerability that can lead to application crashes. The flaw, identified as CVE-2026-61845, exists in all versions of the library before 1.0.7. According to the GitHub advisory GHSA-6wmf-3r64-vcwv, the issue stems from how the gem handles scientific notation in CSS number values.
How it unfolded
- The vulnerability was documented in the GitHub advisory database under ID GHSA-6wmf-3r64-vcwv.
- The advisory specifies that versions of the Crass gem below 1.0.7 are affected by the flaw.
- The vendor released version 1.0.7 to address the security issue and mitigate the risk.
Who is affected
Organizations using the Crass Ruby gem to parse CSS strings are at risk. The vulnerability is rated high severity according to the advisory. Applications that process attacker-controlled CSS input can be forced to consume excessive CPU and memory resources. This disproportionate resource consumption can result in a crash of the affected application. The flaw is present in all releases of Crass prior to version 1.0.7.
Our take on the response
The availability of a patch in version 1.0.7 provides a clear remediation path for users. That suggests teams can resolve the issue by updating their dependencies. The advisory clearly defines the impact as resource exhaustion leading to crashes, which helps prioritize the update. There is no indication of complex workarounds being necessary, as the fix is contained within the library update itself.
Who needs to act first
Teams should prioritize updating systems that expose CSS parsing to external users. Check inventory for applications relying on Crass versions below 1.0.7. Roll out the update in a staging environment first to ensure compatibility. Back up configurations before applying changes. If immediate updates are not possible, consider restricting input sources or implementing rate limiting to reduce exposure while a fix is deployed.
What to do and how to stay safe: Crass
- Update the Crass Ruby gem to version 1.0.7 or later in all affected applications.
- Scan dependency trees to identify any indirect usage of vulnerable Crass versions.
- Monitor application logs for signs of excessive CPU or memory usage during CSS parsing.
- Validate that the updated gem functions correctly with existing CSS inputs in a test environment.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for the Crass vulnerability?
The vulnerability is identified as CVE-2026-61845.
Which versions of Crass are vulnerable?
All versions of the Crass gem prior to 1.0.7 are affected by this flaw.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in Crass version 1.0.7.
