MEDIUM GitHub
CVE-2026-61848
Crass: Non-ASCII characters cause superlinear CPU consumption
### Impact
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
### Patches
This is fixed in Crass 1.0.7.
### Workarounds
Avoid passing non-ASCII input to Crass. Or cultivate patience.
Affected Products
- rubygems/crass < 1.0.7
References
- https://github.com/advisories/GHSA-8vfg-2r28-hvhj
- https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj
- https://github.com/rgrove/crass/releases/tag/v1.0.7
- http://github.com/rgrove/crass/commit/da29664648bf80a97a6439e030a4814291c9afa5
This medium severity vulnerability was published on 2026-10-29 via GitHub. Affected: rubygems/crass < 1.0.7.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.