Cloudanix VulnDB

CVE-2026-61847

None

CVSS

—

EPSS

—

Published

Oct 30, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A common tool used to read style files in Ruby programs can be tricked into crashing by a specially crafted file, temporarily taking down any service that uses it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Unbounded recursion in comment token consumption path when :preserve_comments is disabled (default) allows a malicious stylesheet containing a large number of adjacent comments to exhaust the call stack and raise SystemStackError, terminating the parsing process.

Why it matters to the business

Applications that parse untrusted CSS become unavailable after processing a single crafted stylesheet, causing service disruption; the flaw is one day old with no known exploitation yet but requires immediate patching because the affected library is widely used in Ruby web stacks.

How an attack unfolds

An attacker supplies a stylesheet containing thousands of adjacent CSS comments to any application endpoint that invokes Crass without the :preserve_comments option; the parser recursively consumes each comment token until the Ruby stack overflows, resulting in denial of service.

How to fix it

Upgrade Crass to version 1.0.7 or later; as a temporary mitigation, enable the :preserve_comments option when instantiating the parser if an upgrade is not immediately feasible.

How to confirm the fix worked

Confirm the installed Crass gem version is 1.0.7 or newer; test that a stylesheet with a large number of adjacent comments no longer triggers SystemStackError when parsed with default options.

Typical attack path

  1. Identify an application endpoint or job that parses attacker-controlled CSS using Crass with default options
  2. Generate a stylesheet containing a very large number of adjacent /* */ comments
  3. Submit the stylesheet via the identified input channel
  4. Observe the target process terminate with SystemStackError

How to detect it

Search application and web-server logs for requests that deliver CSS containing unusually long sequences of comment tokens; monitor Ruby process logs and crash reports for SystemStackError originating from Crass comment-handling methods.

What your security team should do

  • Immediately upgrade all Crass installations to 1.0.7 across development, staging, and production environments
  • Add dependency scanning rules to block future builds that pull versions prior to 1.0.7
  • Review any custom CSS parsing code to ensure :preserve_comments is not inadvertently left disabled on untrusted input

The record

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities