PT-2026-132859
CVE-2026-61846
·
Published
2026-10-29
·
Updated
2026-10-30
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Crass versions prior to 1.0.7
Description
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can cause the system to recurse until Ruby raises a
SystemStackError (a failure occurring when the call stack exceeds its limit) or result in excessive memory usage.Recommendations
Update to version 1.0.7.
Add
SystemStackError handling around Crass calls in the application.
Increase available system RAM. Found an issue in the description? Have something to add? Feel free to write us 👾