MEDIUM GitHub
CVE-2026-61846
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
### Impact
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage.
### Patches
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
### Workarounds
Add `SystemStackError` handling around Crass calls in your application. Buy more RAM.
Affected Products
- rubygems/crass < 1.0.7
References
- https://github.com/advisories/GHSA-6jxj-px6v-747w
- https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
- https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99
- https://github.com/rgrove/crass/releases/tag/v1.0.7
This medium severity vulnerability was published on 2026-10-29 via GitHub. Affected: rubygems/crass < 1.0.7.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.