{"id":"CVE-2026-61845","aliases":[],"cve":{"records":[{"id":"CVE-2026-61845","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T20:28:17.513Z","published":"2026-10-30T18:41:58.369Z","modified":"2026-10-30T19:41:24.227Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T18:41:58.369Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T19:41:24.227Z"}],"references":[{"url":"https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/commit/ea6726b7f7cf7e85b23aa2240b8512b4f8d11ad9","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-789","description":"CWE-789: Memory Allocation with Excessive Size Value","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T19:40:36.690821Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Crass: Large numeric exponents cause CPU and memory denial of service","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.","score":8.9,"severity":"high","published":"2026-10-30T18:41:58.369Z","modified":"2026-10-30T19:41:24.227Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"rgrove","name":"crass","platforms":[],"versions":[{"version":"< 1.0.7","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61845"}],"remediation":[],"references":["https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv","https://github.com/rgrove/crass/commit/ea6726b7f7cf7e85b23aa2240b8512b4f8d11ad9","https://github.com/rgrove/crass/releases/tag/v1.0.7"],"sources":[{"name":"CVE","id":"CVE-2026-61845","modified":"2026-10-30T19:41:24.227Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61845"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":8.9}],"sourceAffected":[],"observedAt":"2026-10-30T21:05:43.344Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Crass, a Ruby CSS parser, has a vulnerability in versions prior to 1.0.7 where large numeric exponents in CSS scientific notation can cause a denial of service due to excessive CPU and memory usage. An attacker with access to the CSS parser input can exploit this weakness. The issue is fixed in version 1.0.7.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:21:18.360Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-61845"}]}}