{"id":"GHSA-8vfg-2r28-hvhj","aliases":["CVE-2026-61848"],"title":"Crass: Non-ASCII characters cause superlinear CPU consumption","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n\nWhen parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.\n\n### Patches\n\nThis is fixed in Crass 1.0.7.\n\n### Workarounds\n\nAvoid passing non-ASCII input to Crass. Or cultivate patience.","severity":"medium","score":6.3,"published":"2026-10-29T16:35:29.000Z","modified":"2026-10-30T18:45:20.036Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"RubyGems","name":"crass","sources":[{"name":"OSV · GHSA-8vfg-2r28-hvhj","url":"https://osv.dev/vulnerability/GHSA-8vfg-2r28-hvhj"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.7"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6"],"fixed":["1.0.7"]}],"sourceAffected":[],"references":["https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj","https://github.com/rgrove/crass","https://github.com/rgrove/crass/releases/tag/v1.0.7","http://github.com/rgrove/crass/commit/da29664648bf80a97a6439e030a4814291c9afa5"],"sources":[{"name":"OSV","id":"GHSA-8vfg-2r28-hvhj","modified":"2026-10-29T16:45:04.487777722Z","url":"https://osv.dev/vulnerability/GHSA-8vfg-2r28-hvhj"},{"name":"CVE","id":"CVE-2026-61848","modified":"2026-10-30T18:45:20.036Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61848"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3},{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3}],"cve":{"records":[{"id":"CVE-2026-61848","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T20:28:17.513Z","published":"2026-10-30T18:45:20.036Z","modified":"2026-10-30T18:45:20.036Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T18:45:20.036Z"}],"references":[{"url":"https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"http://github.com/rgrove/crass/commit/da29664648bf80a97a6439e030a4814291c9afa5","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"rgrove","name":"crass","platforms":[],"versions":[{"version":"< 1.0.7","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61848"}],"remediation":[],"observedAt":"2026-10-30T18:56:49.580Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:15:32.758Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T10:10:32.958Z","attemptedAt":"2026-10-30T10:10:32.958Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T10:10:32.236Z","attemptedAt":"2026-10-30T10:10:32.236Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T10:10:32.143Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:10:31.921Z","attemptedAt":"2026-10-30T10:10:31.921Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-8vfg-2r28-hvhj","url":"https://github.com/advisories/GHSA-8vfg-2r28-hvhj","modified":"2026-10-29T16:35:33Z","checkedAt":"2026-10-30T10:10:32.236Z"}],"aiSummary":null}