요약
- CVE-2026-61848은(는) crass에 영향을 주는 보통 (CVSS 6.3) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.49%, 전체 취약점의 42.1%보다 높음.
- 조치: 1.0.7 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| crass RubyGems | < 1.0.7
| 1.0.7
|
Description
Impact
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
Patches
This is fixed in Crass 1.0.7.
Workarounds
Avoid passing non-ASCII input to Crass. Or cultivate patience.
NVD description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free