Cloudanix VulnDB

CVE-2026-61845

None

CVSS

—

EPSS

—

Published

Oct 30, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

An attacker can send specially crafted CSS that makes programs using this library consume so much computer power they may crash.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The flaw permits unbounded exponentiation during conversion of CSS scientific notation numeric values prior to clamping against Float::MAX, resulting in excessive CPU and memory consumption from attacker-supplied input.

Why it matters to the business

Applications handling untrusted CSS may experience sudden resource exhaustion leading to crashes or degraded service availability, with urgency heightened by the vulnerability's publication only one day ago.

How an attack unfolds

An attacker supplies a minimal CSS string containing a scientific notation value with an extremely large exponent to a vulnerable Crass parser instance, forcing disproportionate computation and memory allocation that can crash the consuming application.

How to fix it

Upgrade the Crass gem to version 1.0.7 or later; verify the resolved version in Gemfile.lock or equivalent dependency manifests.

How to confirm the fix worked

Confirm the installed Crass version is at least 1.0.7, then attempt parsing a test CSS string containing a large-exponent scientific notation value and verify resource usage remains bounded.

Typical attack path

  1. Locate an application endpoint or feature that parses attacker-controlled CSS using Crass prior to 1.0.7
  2. Craft a compact CSS payload containing a scientific notation number with an unbounded exponent
  3. Submit the payload to trigger parsing
  4. Observe rapid CPU and memory growth culminating in application instability or crash

How to detect it

Review application logs and system metrics for anomalous CPU or memory consumption correlated with CSS parsing activity; inspect for repeated parsing of unusually small inputs that trigger high resource use.

What your security team should do

  • Upgrade Crass to 1.0.7 immediately given the one-day publication window
  • Scan dependency manifests across all Ruby applications for the vulnerable version
  • Implement input-size or parsing-time limits around CSS processing as a defense-in-depth measure
  • Monitor application logs and metrics for sudden spikes in CPU or memory during CSS parsing

The record

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities