Crass Ruby CSS Parser Bug Exhausts Server Resources via Unbounded Exponentiation
A high-severity vulnerability in the Crass Ruby gem allows attackers to exhaust server resources by injecting crafted CSS strings with unbounded exponentiation.
Key points
- The flaw affects Crass versions prior to 1.0.7 and is assigned CVE-2026-61845.
- Attackers can force disproportionate CPU and memory usage with tiny input strings.
- A patch is available in version 1.0.7 to clamp results to Float::MAX limits.
Security researchers identified a high-severity flaw in the Crass Ruby gem that permits attackers to exhaust server resources through malformed CSS input. According to GitHub advisory GHSA-6wmf-3r64-vcwv, the vulnerability stems from how the library processes scientific notation numbers. Applications relying on Crass to parse user-controlled CSS strings are directly exposed to this risk. The issue was assigned CVE-2026-61845 and rated as high severity due to its potential for denial-of-service impacts.
The risk
The Crass gem converts CSS scientific notation values using unbounded exponentiation before applying limits. This processing order allows an attacker to craft a small input string that triggers excessive computational work. According to the advisory, this disproportionate resource consumption can lead to significant CPU and memory strain. In severe cases, the application may crash entirely. The flaw exists because the library fails to clamp intermediate values to Float::MAX during the calculation phase, enabling resource abuse.
Who is exposed
Any application using Crass versions older than 1.0.7 is vulnerable to this exploitation method. The risk is highest for web applications that accept and parse CSS input from untrusted users or external services. If an application allows users to submit custom stylesheets or inline CSS styles, those inputs must be considered potentially malicious. The vulnerability does not require complex payloads; tiny inputs are sufficient to trigger the resource exhaustion behavior described in the advisory.
Cost and compliance
No specific financial costs or compliance mandates are detailed in the source material regarding this vulnerability. The advisory focuses on the technical impact of resource exhaustion and the availability of a software patch. Organizations should evaluate their exposure based on their internal risk tolerance and application architecture. Compliance implications depend on how the affected application handles data and whether the service disruption violates existing service-level agreements or regulatory uptime requirements.
What to watch
Teams should immediately audit their dependency trees to identify any usage of Crass versions below 1.0.7. Monitor server performance metrics for sudden spikes in CPU or memory usage that correlate with CSS parsing activities. Verify that your application restricts or sanitizes CSS input from unauthenticated users to reduce the attack surface. Prioritize upgrading the library to the patched version to eliminate this specific vector for resource exhaustion.
Signals worth monitoring
Defenders should look for unusual spikes in processor load or memory consumption on web servers handling user-generated content. Check logs for repeated requests containing complex or unusual CSS strings, particularly those with scientific notation. Alert on application timeouts or crashes that occur without a corresponding increase in traffic volume. Teams usually implement rate limiting on endpoints that accept styling inputs to mitigate the impact of such resource-intensive parsing flaws during an active incident.
What to do and how to stay safe: Crass
- Update the Crass Ruby gem to version 1.0.7 or later to apply the official fix.
- Review application logs for signs of resource exhaustion or abnormal CPU usage patterns.
- Restrict CSS input fields to trusted administrators or validated style libraries where possible.
- Monitor server performance dashboards for sudden, unexplained spikes in processing load.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Crass are affected by this vulnerability?
All versions of the Crass Ruby gem prior to 1.0.7 are vulnerable to this resource exhaustion flaw.
Is there a patch available for CVE-2026-61845?
Yes, the vulnerability is fixed in Crass version 1.0.7, which clamps results to Float::MAX.
What is the severity rating of this CVE?
The advisory rates the severity of CVE-2026-61845 as high due to its potential for denial-of-service.
