CVE-2026-61845: Crass : Large numeric exponents cause CPU and memory denial of service
Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.
References
- github.com/advisories/GHSA-6wmf-3r64-vcwv
- github.com/rgrove/crass/releases/tag/v1.0.7
- github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
- github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
- nvd.nist.gov/vuln/detail/CVE-2026-61845
- rubygems.org/gems/crass/versions/1.0.7
Code Behaviors & Features
Detect and mitigate CVE-2026-61845 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →