Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-61847Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Medium 6.3

In plain English

A medium-severity security flaw in crass from rgrove. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.5%top 58.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-crassno fix listedDEBIAN-CVE-2026-61847
Debian:13ruby-crassno fix listedDEBIAN-CVE-2026-61847
Debian:14ruby-crass1.0.7-1DEBIAN-CVE-2026-61847
RubyGemscrass1.0.7GHSA-wwpr-jff3-395c
Ubuntu:22.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-61847
Ubuntu:24.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-61847
Ubuntu:26.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-61847
Ubuntu:26.10ruby-crassno fix listedUBUNTU-CVE-2026-61847

Affected products (as reported)

VendorProductVersions
rgrove crass < 1.0.7

Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References