Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61846— Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

Quick assessment

Affected
rgrove crass
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Crass 是一个完全符合 CSS 语法第 3 级规范的 Ruby CSS 解析器。在 1.0.7 版本之前，Crass 在解析 CSS 简单块和函数时会递归执行，且未设置深度限制。攻击者可构造包含深度嵌套块或函数的 CSS 值，导致解析过程无限递归，直至 Ruby 抛出 （错误提示：栈层级过深），或引发内存过度消耗。1.0.7 版本引入了可配置的最大深度限制，并采用保守的默认值。该问题已在 1.0.7 版本中修复。

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
rgrove crass < 1.0.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61846

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Source: CVE Program / CVE List V5
Vulnerability Description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
rgrove crass < 1.0.7 -

II. Public POCs for CVE-2026-61846

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61846

请登录查看更多情报信息。

Other References for CVE-2026-61846 (3)

Same Patch Batch · rgrove · 2026-10-30 · 4 CVEs total

CVE-2026-61845 8.9 HIGH Crass: Large numeric exponents cause CPU and memory denial of service
CVE-2026-61847 6.3 MEDIUM Crass: A large number of adjacent CSS comments can trigger a SystemStackError
CVE-2026-61848 6.3 MEDIUM Crass: Non-ASCII characters cause superlinear CPU consumption

IV. Related Vulnerabilities

Same product: crass
Same vendor: rgrove
Same weakness: CWE-674