---
id: CVE-2026-61846
aliases:
  - GHSA-6jxj-px6v-747w
title: >-
  Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError
  or excessive memory usage
summary: >-
  Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError
  or excessive memory usage
severity: medium
cwe:
  - CWE-400
vendor: crass
product: crass
ecosystem: rubygems
affected:
  - crass < 1.0.7
patched:
  - crass 1.0.7
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T16:35:18Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6jxj-px6v-747w'
references:
  - url: 'https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w'
  - url: >-
      https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99
  - url: 'https://github.com/rgrove/crass/releases/tag/v1.0.7'
  - url: 'https://github.com/advisories/GHSA-6jxj-px6v-747w'
tags:
  - ghsa
  - rubygems
ingestedAt: '2026-10-29T16:38:25.971Z'
epss: 0.00486
epssPercentile: 0.41938
---

## Overview

### Impact

Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage.

### Patches

This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.

### Workarounds

Add `SystemStackError` handling around Crass calls in your application. Buy more RAM.

## Affected packages

- `crass < 1.0.7`

## Remediation

Upgrade to a patched release:

- `crass 1.0.7`