Vulnerability GHSA-6jxj-px6v-747w
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 day ago
October 29, 2026 at 04:35 PM UTC
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
0.0.1 - 1.0.6
0.0.1 - 1.0.6
Summary
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Details
Impact
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.
Patches
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
Workarounds
Add SystemStackError handling around Crass calls in your application. Buy more RAM.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
1 day ago
Crass: Non-ASCII characters cause superlinear CPU consumption
0.0.1 - 1.0.6 GHSA-8vfg-2r28-hvhj
0.0.1 - 1.0.6 GHSA-8vfg-2r28-hvhj
Medium Risk
1 day ago
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
0.0.1 - 1.0.6 GHSA-wwpr-jff3-395c
0.0.1 - 1.0.6 GHSA-wwpr-jff3-395c
Medium Risk
2 days ago
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
0.0.1 - 1.0.7 GHSA-pq4g-8rxf-4g29
0.0.1 - 1.0.7 GHSA-pq4g-8rxf-4g29
High Risk
10 days ago
Crass : Large numeric exponents cause CPU and memory denial of service
0.0.1 - 1.0.6 GHSA-6wmf-3r64-vcwv
0.0.1 - 1.0.6 GHSA-6wmf-3r64-vcwv
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 04:35 PM UTC
Fixed (1.0.7)
4 months ago
June 25, 2026 at 05:09 PM UTC
Last Modified
1 day ago
October 29, 2026 at 04:45 PM UTC