{"id":"GHSA-6jxj-px6v-747w","aliases":["CVE-2026-61846"],"title":"Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n\nCrass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage.\n\n### Patches\n\nThis is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.\n\n### Workarounds\n\nAdd `SystemStackError` handling around Crass calls in your application. Buy more RAM.","severity":"medium","score":6.3,"published":"2026-10-29T16:35:16.000Z","modified":"2026-10-30T18:43:25.373Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"RubyGems","name":"crass","sources":[{"name":"OSV · GHSA-6jxj-px6v-747w","url":"https://osv.dev/vulnerability/GHSA-6jxj-px6v-747w"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.7"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6"],"fixed":["1.0.7"]}],"sourceAffected":[],"references":["https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w","https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99","https://github.com/rgrove/crass","https://github.com/rgrove/crass/releases/tag/v1.0.7"],"sources":[{"name":"OSV","id":"GHSA-6jxj-px6v-747w","modified":"2026-10-29T16:45:05.394588176Z","url":"https://osv.dev/vulnerability/GHSA-6jxj-px6v-747w"},{"name":"CVE","id":"CVE-2026-61846","modified":"2026-10-30T18:43:25.373Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61846"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3},{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3}],"cve":{"records":[{"id":"CVE-2026-61846","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T20:28:17.513Z","published":"2026-10-30T18:43:25.373Z","modified":"2026-10-30T18:43:25.373Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T18:43:25.373Z"}],"references":[{"url":"https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-674","description":"CWE-674: Uncontrolled Recursion","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"rgrove","name":"crass","platforms":[],"versions":[{"version":"< 1.0.7","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61846"}],"remediation":[],"observedAt":"2026-10-30T18:56:46.246Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T06:35:33.858Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T17:05:32.255Z","attemptedAt":"2026-10-29T17:05:32.255Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T17:05:32.255Z","attemptedAt":"2026-10-29T17:05:32.255Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T17:05:32.261Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T17:05:32.261Z","attemptedAt":"2026-10-29T17:05:32.261Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-6jxj-px6v-747w","url":"https://github.com/advisories/GHSA-6jxj-px6v-747w","modified":"2026-10-29T16:35:18Z","checkedAt":"2026-10-29T17:05:32.255Z"}],"aiSummary":null}