En bref
- CVE-2026-61848 est une vulnérabilité MOYENNE (CVSS 6.3) touchant crass.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.49%, plus élevée que 42.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.0.7 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| crass RubyGems | < 1.0.7
| 1.0.7
|
Description
Impact
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
Patches
This is fixed in Crass 1.0.7.
Workarounds
Avoid passing non-ASCII input to Crass. Or cultivate patience.
NVD description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free