Crass: Denial of service via CSS exponentiation (CVE-2026-61845)

The Crass Ruby gem (versions prior to 1.0.7) is susceptible to a denial of service (DoS) vulnerability, identified as CVE-2026-61845. The library fails to properly validate or limit numeric exponents found in CSS strings during parsing. When an application processes attacker-controlled CSS, an attacker can submit a string containing an extremely large numeric exponent. The library attempts to calculate the result of this exponentiation before clamping it to the maximum float value, leading to disproportionate CPU and memory consumption. This resource exhaustion can result in application instability or process crashes, impacting any service that relies on Crass for sanitizing or parsing user-supplied CSS.

Impact

The vulnerability allows remote attackers to cause a denial of service on applications using the Crass library to process untrusted CSS content. Successful exploitation leads to excessive resource consumption and application crashes, potentially disrupting availability for all users of the affected service. The vulnerability affects all users of Crass versions below 1.0.7 in any sector utilizing this Ruby gem.

Recommendation

1. Upgrade the Crass gem to version 1.0.7 or later to implement proper clamping of numeric exponents.
2. Implement input validation and length limits for all user-supplied CSS before passing the content to the Crass parser.
3. Monitor application error logs for memory exhaustion or process restarts occurring during CSS parsing operations.