GHSA-8vfg-2r28-hvhj
UnknownSummary
A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.
Risk Assessment
An attacker can send crafted input with many non-ASCII characters, causing CPU overload and potentially exhausting server resources.
Recommendation
Update the Crass library to the latest patched version. If updating is not possible, restrict processing of input containing non-ASCII characters.
Other vulnerabilities in Crass
See all- GHSA-6jxj-px6v-747wUnknown
Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.
- GHSA-6wmf-3r64-vcwvUnknown
The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.
- GHSA-wwpr-jff3-395cUnknown
A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.
Original NVD description (English source)
## Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially d