PT-2026-132860
CVE-2026-61848
·
Published
2026-10-29
·
Updated
2026-10-30
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Name of the Vulnerable Software and Affected Versions
Crass versions prior to 1.0.7
Description
Inefficiencies in tracking the positions of multi-byte characters when parsing input containing non-ASCII characters result in superlinear parsing time. This can lead to excessive CPU consumption and potentially a denial of service when processing attacker-controlled input containing many non-ASCII characters.
Recommendations
Update to version 1.0.7.
Avoid passing non-ASCII input to the software.
Found an issue in the description? Have something to add? Feel free to write us 👾