Vulnerability GHSA-8vfg-2r28-hvhj
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 day ago
October 29, 2026 at 04:35 PM UTC
Crass: Non-ASCII characters cause superlinear CPU consumption
0.0.1 - 1.0.6
0.0.1 - 1.0.6
Summary
Crass: Non-ASCII characters cause superlinear CPU consumption
Details
Impact
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
Patches
This is fixed in Crass 1.0.7.
Workarounds
Avoid passing non-ASCII input to Crass. Or cultivate patience.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
1 day ago
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
0.0.1 - 1.0.6 GHSA-wwpr-jff3-395c
0.0.1 - 1.0.6 GHSA-wwpr-jff3-395c
Medium Risk
1 day ago
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
0.0.1 - 1.0.6 GHSA-6jxj-px6v-747w
0.0.1 - 1.0.6 GHSA-6jxj-px6v-747w
Medium Risk
2 days ago
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
0.0.1 - 1.0.7 GHSA-pq4g-8rxf-4g29
0.0.1 - 1.0.7 GHSA-pq4g-8rxf-4g29
High Risk
10 days ago
Crass : Large numeric exponents cause CPU and memory denial of service
0.0.1 - 1.0.6 GHSA-6wmf-3r64-vcwv
0.0.1 - 1.0.6 GHSA-6wmf-3r64-vcwv
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 04:35 PM UTC
Fixed (1.0.7)
4 months ago
June 25, 2026 at 05:09 PM UTC
Last Modified
1 day ago
October 29, 2026 at 04:45 PM UTC