GHSA-wwpr-jff3-395c
UnknownSummary
A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.
Risk Assessment
An attacker can remotely overload a server or application using Crass to process CSS, leading to denial of service (DoS) and disruption of user operations.
Recommendation
Update the Crass library to the latest patched version. If an update is not possible, consider enabling the :preserve_comments option or limiting the size of processed stylesheets.
Other vulnerabilities in Crass
See all- GHSA-6jxj-px6v-747wUnknown
Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.
- GHSA-6wmf-3r64-vcwvUnknown
The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.
- GHSA-8vfg-2r28-hvhjUnknown
A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.
Original NVD description (English source)
## Impact When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a Sys