CVE-2026-61845
HighSummary
A vulnerability in the Crass library involves unbounded exponentiation when converting CSS scientific notation number values before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to consume excessive CPU and memory when processing a tiny input.
Risk Assessment
An attacker can exploit this vulnerability to cause a denial of service (DoS) by supplying specially crafted CSS, potentially leading to resource exhaustion and service unavailability.
Recommendation
Update the Crass library to a patched version or restrict parsing of CSS from untrusted sources. Monitor resource usage during CSS processing and consider implementing limits.
Other vulnerabilities in Crass
See all- GHSA-6jxj-px6v-747wUnknown
Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.
- GHSA-6wmf-3r64-vcwvUnknown
The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.
- GHSA-8vfg-2r28-hvhjUnknown
A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.
- GHSA-wwpr-jff3-395cUnknown
A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.
Original NVD description (English source)
### Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resul
Vulnerability data from NVD (NIST) · CISA KEV · EPSS