Cloudanix VulnDB

CVE-2026-61846

None

CVSS

—

EPSS

—

Published

Oct 30, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in a Ruby library that reads CSS code lets attackers send specially crafted style information that can crash or slow down the program handling it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Unbounded recursive parsing of CSS simple blocks and functions allows an attacker-supplied CSS value to trigger Ruby SystemStackError or excessive memory consumption until the process crashes or becomes unresponsive.

Why it matters to the business

Applications or services that parse untrusted CSS can be taken offline or degraded, causing denial of service to users and requiring emergency restarts or resource limits.

How an attack unfolds

An attacker crafts a CSS string containing many levels of nested blocks or functions and supplies it to any code path that invokes Crass parsing; the parser recurses until the Ruby stack limit is hit or memory is exhausted, resulting in an unhandled exception or process termination.

How to fix it

Upgrade Crass to version 1.0.7 or later, which introduces a configurable recursion depth limit with a safe default; restart affected services after the upgrade.

How to confirm the fix worked

Confirm the installed gem version is at least 1.0.7; test by submitting a CSS payload with nesting depth greater than the configured limit and verify that a controlled error is raised instead of a stack overflow.

Typical attack path

  1. Identify an entry point that accepts attacker-controlled CSS input
  2. Generate a deeply nested CSS value exceeding the default recursion depth
  3. Submit the value through the normal parsing code path
  4. Observe process crash or high CPU/memory consumption confirming impact

How to detect it

Monitor application logs for uncaught SystemStackError exceptions originating from Crass parsing routines; review request logs for unusually large or deeply nested CSS payloads submitted shortly before crashes.

What your security team should do

  • Immediately inventory all Ruby applications that depend on the Crass gem and schedule the upgrade to 1.0.7
  • Add dependency scanning to CI pipelines to block future builds that use versions prior to 1.0.7
  • Implement runtime resource limits or circuit breakers around CSS parsing to reduce blast radius until patches are applied

The record

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities