CVE-2026-61846Medium▾ SunlitCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage.
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
Add SystemStackError handling around Crass calls in your application. Buy more RAM.
crass < 1.0.7Upgrade to a patched release:
crass 1.0.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61848MediumCrass: Non-ASCII characters cause superlinear CPU consumption
CVE-2026-61847MediumCrass: A large number of adjacent CSS comments can trigger a SystemStackError
CVE-2026-61845HighCrass : Large numeric exponents cause CPU and memory denial of service
CVE-2026-116695Medium· 5.3Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
CVE-2025-11635Medium· 4.3A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036
CVE-2025-48392High· 7.5A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.