Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-61845Crass: Large numeric exponents cause CPU and memory denial of service

High 8.9

In plain English

A high-severity security flaw in crass from rgrove. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.4%top 67.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-crassno fix listedDEBIAN-CVE-2026-61845
Debian:13ruby-crassno fix listedDEBIAN-CVE-2026-61845
Debian:14ruby-crass1.0.7-1DEBIAN-CVE-2026-61845
RubyGemscrass1.0.7GHSA-6wmf-3r64-vcwv
Ubuntu:22.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-61845
Ubuntu:24.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-61845
Ubuntu:26.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-61845
Ubuntu:26.10ruby-crassno fix listedUBUNTU-CVE-2026-61845

Affected products (as reported)

VendorProductVersions
rgrove crass < 1.0.7

Weakness: CWE-789 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References