CVE-2026-61848

Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.

A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.

Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.

Crass, a Ruby CSS parser, prior to 1.0.7, when the :preserve_comments option is disabled (the default), discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet with a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application.

Crass, a Ruby CSS parser, prior to 1.0.7 recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises a SystemStackError or cause excessive memory usage.

In Crass (a Ruby CSS parser compliant with CSS Syntax Level 3) before 1.0.7, scientific-notation number values are converted with unbounded exponentiation before clamping to Float::MAX. Applications parsing attacker-controlled CSS can be forced to spend disproportionate CPU and memory on a tiny input, potentially causing a crash.

In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.