CVE-2026-61845

Summary

Crass : Large numeric exponents cause CPU and memory denial of service

Severity

high

CWE

CWE-674

Also known as

GHSA-6wmf-3r64-vcwv

Published

2026-10-20

Updated

2026-10-20

Advisory details

Impact

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.

Patches

This is fixed in Crass 1.0.7.

Related

• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml

References

• https://github.com/advisories/GHSA-6wmf-3r64-vcwv
• https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
• https://github.com/rgrove/crass/releases/tag/v1.0.7
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
• https://rubygems.org/gems/crass/versions/1.0.7

Related advisories

• CVE-2026-112895 — high · PyPI/pillow
• CVE-2026-100354 — high · Go/github.com/getkin/kin-openapi
• CVE-2026-58280 — high · NuGet/Microsoft.NETCore.App.Runtime.linux-arm
• CVE-2026-91968 — high · Go/code.vikunja.io/api
• CVE-2026-107826 — high · Go/github.com/corazawaf/coraza/v3
• CVE-2026-107300 — high · npm/msgpack5
• CVE-2026-107216 — high · Go/github.com/xuri/excelize/v2
• CVE-2026-18140 — high · crates.io/aws-smithy-json

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity