All vulnerabilities
CVE-2026-61845GHSA-6wmf-3r64-vcwv

Crass : Large numeric exponents cause CPU and memory denial of service

crassrubygemsLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.9High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.0.7Fixed versionGitHub
Published20 Oct 2026Updated 20 Oct 2026GitHub

What fixes it

  • 1.0.7crass, rubygemsGitHub
  • 1.0.7crass, RubyGemsOSVbundle update crass --conservative # needs 1.0.7 or later

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.

Patches

This is fixed in Crass 1.0.7.

Related

  • https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml

Text from GitHub Advisory Database

Affected versions 14

  • crass, rubygems< 1.0.7GitHub
  • crass, RubyGemsfrom first release, fixed in 1.0.7OSV
  • crass, RubyGems0.0.1OSV
  • crass, RubyGems0.0.2OSV
  • crass, RubyGems0.1.0OSV
  • crass, RubyGems0.2.0OSV
  • crass, RubyGems0.2.1OSV
  • crass, RubyGems1.0.0OSV
  • crass, RubyGems1.0.1OSV
  • crass, RubyGems1.0.2OSV
  • crass, RubyGems1.0.3OSV
  • crass, RubyGems1.0.4OSV
  • crass, RubyGems1.0.5OSV
  • crass, RubyGems1.0.6OSV

References 5