CVE-2026-61848Medium▾ SunlitCrass: Non-ASCII characters cause superlinear CPU consumption
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
This is fixed in Crass 1.0.7.
Avoid passing non-ASCII input to Crass. Or cultivate patience.
crass < 1.0.7Upgrade to a patched release:
crass 1.0.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61846MediumCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
CVE-2026-61847MediumCrass: A large number of adjacent CSS comments can trigger a SystemStackError
CVE-2026-61845HighCrass : Large numeric exponents cause CPU and memory denial of service
CVE-2026-116695Medium· 5.3Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
CVE-2025-11635Medium· 4.3A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036
CVE-2025-48392High· 7.5A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.