CVE-2026-61846: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

October 29, 2026

Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.

References

github.com/advisories/GHSA-6jxj-px6v-747w
github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99
github.com/rgrove/crass/releases/tag/v1.0.7
github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
nvd.nist.gov/vuln/detail/CVE-2026-61846

Code Behaviors & Features

Detect and mitigate CVE-2026-61846 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →