{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acrass_projectcrassruby/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:crass_project:crass:*:*:*:*:*:ruby:*:*"],"_cs_cves":[{"id":"CVE-2026-61845"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["crass (\u003c 1.0.7)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","ruby","css"],"_cs_type":"advisory","_cs_vendors":["RubyGems"],"content_html":"\u003cp\u003eThe Crass Ruby gem (versions prior to 1.0.7) is susceptible to a denial of service (DoS) vulnerability, identified as CVE-2026-61845. The library fails to properly validate or limit numeric exponents found in CSS strings during parsing. When an application processes attacker-controlled CSS, an attacker can submit a string containing an extremely large numeric exponent. The library attempts to calculate the result of this exponentiation before clamping it to the maximum float value, leading to disproportionate CPU and memory consumption. This resource exhaustion can result in application instability or process crashes, impacting any service that relies on Crass for sanitizing or parsing user-supplied CSS.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows remote attackers to cause a denial of service on applications using the Crass library to process untrusted CSS content. Successful exploitation leads to excessive resource consumption and application crashes, potentially disrupting availability for all users of the affected service. The vulnerability affects all users of Crass versions below 1.0.7 in any sector utilizing this Ruby gem.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the Crass gem to version 1.0.7 or later to implement proper clamping of numeric exponents.\u003c/li\u003e\n\u003cli\u003eImplement input validation and length limits for all user-supplied CSS before passing the content to the Crass parser.\u003c/li\u003e\n\u003cli\u003eMonitor application error logs for memory exhaustion or process restarts occurring during CSS parsing operations.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T14:43:22Z","date_published":"2026-10-20T14:43:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-crass-dos/","summary":"The Crass Ruby gem is vulnerable to a denial of service condition where maliciously crafted CSS numeric exponents trigger excessive CPU and memory consumption.","title":"Crass: Denial of service via CSS exponentiation (CVE-2026-61845)","url":"https://feed.craftedsignal.io/briefs/2026-10-crass-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:crass_project:crass:*:*:*:*:*:ruby:*:*","version":"https://jsonfeed.org/version/1.1"}