PT-2026-133260

CVE-2026-61847

Published

2026-10-29

Updated

2026-10-30

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions Crass versions prior to 1.0.7

Description When the :preserve comments option is disabled (the default setting), the parser discards CSS comments by recursively consuming the next token. A stylesheet containing a large number of adjacent comments can lead to excessive recursion, triggering a SystemStackError and resulting in a denial of service for the application.

Recommendations Update to version 1.0.7. Set the :preserve comments option to true as a temporary workaround.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-674: Uncontrolled Recursion

Related identifiers

CVE-2026-61847