Cloudanix VulnDB

CVE-2026-61848

None

CVSS

—

EPSS

—

Published

Oct 30, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in a library that reads website style files lets attackers send specially crafted text that can slow down or crash the systems using it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Inefficiencies in multi-byte character position tracking during CSS parsing cause superlinear time complexity when processing non-ASCII input, resulting in excessive CPU consumption.

Why it matters to the business

Attackers can trigger high CPU usage and potential denial of service against applications that parse untrusted CSS, disrupting availability of services that rely on this parser.

How an attack unfolds

An attacker supplies a crafted CSS stylesheet containing a large number of non-ASCII characters to any application using a vulnerable version of the Crass parser; the parser's position-tracking logic degrades into quadratic or worse behavior, exhausting CPU resources.

How to fix it

Upgrade the Crass gem to version 1.0.7 or later. Validate the update by confirming the installed version reports 1.0.7 or higher and re-testing parsing of non-ASCII CSS inputs for linear performance.

How to confirm the fix worked

Inspect the application's dependency manifest or Gemfile.lock for the crass version; perform a benchmark parse of a large non-ASCII CSS file before and after the upgrade to confirm linear-time behavior.

Typical attack path

  1. Locate an application endpoint or component that accepts and parses attacker-controlled CSS using Crass
  2. Generate a malicious stylesheet payload consisting predominantly of non-ASCII characters sized to trigger superlinear parsing
  3. Submit the payload via the identified input vector
  4. Monitor for elevated CPU utilization and service degradation on the target

How to detect it

Monitor process CPU usage and Ruby worker logs for sudden spikes correlated with CSS parsing operations; inspect incoming CSS payloads or template inputs for unusually high ratios of non-ASCII characters.

What your security team should do

  • Immediately audit all Ruby applications for use of Crass versions prior to 1.0.7
  • Prioritize upgrade to 1.0.7 across all environments within the next 48 hours given the public disclosure and trivial attack requirements
  • Add Crass version checks to continuous dependency scanning pipelines
  • Review any custom CSS sanitization or preprocessing logic that may still feed untrusted input to the parser

The record

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities