GHSA-wwpr-jff3-395c

Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.

Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.

Crass (a Ruby CSS parser) prior to 1.0.7 inefficiently tracks positions of multi-byte characters when parsing input containing non-ASCII characters. This results in superlinear parsing time, and an attacker can supply CSS with many non-ASCII characters, causing excessive CPU consumption and potential denial of service.

Crass, a Ruby CSS parser, prior to 1.0.7, when the :preserve_comments option is disabled (the default), discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet with a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application.

Crass, a Ruby CSS parser, prior to 1.0.7 recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises a SystemStackError or cause excessive memory usage.

In Crass (a Ruby CSS parser compliant with CSS Syntax Level 3) before 1.0.7, scientific-notation number values are converted with unbounded exponentiation before clamping to Float::MAX. Applications parsing attacker-controlled CSS can be forced to spend disproportionate CPU and memory on a tiny input, potentially causing a crash.

In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.