MEDIUM GitHub
CVE-2026-61847
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
### Impact
When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`.
### Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
### Workarounds
Set the `:preserve_comments` option to `true` if this is acceptable
Affected Products
- rubygems/crass < 1.0.7
References
- https://github.com/advisories/GHSA-wwpr-jff3-395c
- https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
- https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5
- https://github.com/rgrove/crass/releases/tag/v1.0.7
This medium severity vulnerability was published on 2026-10-29 via GitHub. Affected: rubygems/crass < 1.0.7.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.