Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Published: June 25, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-61846 (NVD)
- GHSA: GHSA-6jxj-px6v-747w
- Vendor Advisory: https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
GEM
PATCHED VERSIONS
>= 1.0.7
DESCRIPTION
Impact
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.
RELATED
- https://www.cve.org/CVERecord?id=CVE-2026-61846
- https://rubygems.org/gems/crass/versions/1.0.7
- https://github.com/rgrove/crass/releases/tag/v1.0.7
- https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md#107-2026-06-25
- https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99
- https://advisories.gitlab.com/gem/crass/CVE-2026-61846
- https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
- https://github.com/advisories/GHSA-6jxj-px6v-747w