CVE-2026-61846

Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.

A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.

Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.

Crass (a Ruby CSS parser) prior to 1.0.7 inefficiently tracks positions of multi-byte characters when parsing input containing non-ASCII characters. This results in superlinear parsing time, and an attacker can supply CSS with many non-ASCII characters, causing excessive CPU consumption and potential denial of service.

Crass, a Ruby CSS parser, prior to 1.0.7, when the :preserve_comments option is disabled (the default), discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet with a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application.

In Crass (a Ruby CSS parser compliant with CSS Syntax Level 3) before 1.0.7, scientific-notation number values are converted with unbounded exponentiation before clamping to Float::MAX. Applications parsing attacker-controlled CSS can be forced to spend disproportionate CPU and memory on a tiny input, potentially causing a crash.

In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.