CVE-2026-61846

A vulnerability in the Crass library involves unbounded exponentiation when converting CSS scientific notation number values before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to consume excessive CPU and memory when processing a tiny input.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.

A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.

When the :preserve_comments option is not enabled (the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker providing a stylesheet with a very large number of adjacent comments can cause excessive recursion.

When parsing input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. Attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption.

Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.

Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.

In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.