Crass: Denial of service via oversized CSS numeric exponents
Summary
Crass, a Ruby CSS parser, processes numeric exponents in CSS values without bounding them before clamping the result to Float::MAX. An attacker who can supply CSS strings to an application that parses them with Crass can send a tiny input that forces excessive CPU and memory use, potentially crashing the process. The vendor describes this as a denial of service; no confidentiality or integrity impact is stated.
Affected
- Crass versions before 1.0.7
Fixed in
- Crass 1.0.7 (bounds exponents before 10**exponent is computed)
Workaround
- No vendor workaround documented.
- Upgrading to 1.0.7 is the fix.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Identify Ruby applications that use Crass directly or indirectly (for example through loofah or rails-html-sanitizer) and check their Gemfile.lock.
- Update crass to 1.0.7 or later and redeploy affected applications.
- If an update is not possible immediately, limit the size of CSS and HTML input accepted by the application and apply rate limits to endpoints that accept it.
- Check Linux distribution packages (ruby-crass) for fixed versions, as backport status is unknown.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6wmf-3r64-vcwv (vendor) github.com
- Crass v1.0.7 release github.com
- Fix commit ea6726b github.com
- GitHub Advisory Database GHSA-6wmf-3r64-vcwv github.com
- OSV GHSA-6wmf-3r64-vcwv osv.dev
- RubySec advisory GHSA-6wmf-3r64-vcwv rubysec.com
- GitLab advisory database CVE-2026-61845 advisories.gitlab.com
- Debian CVE entry (vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:24.
Original description (NVD)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.