https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-03T22:02:18.836815+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-61845 fkie_cve-2026-61845 2026-11-03T22:02:18.856172+00:00

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.

 https://db.gcve.eu/vuln/ghsa-6wmf-3r64-vcwv GHSA-6wmf-3r64-vcwv — Crass : Large numeric exponents cause CPU and memory denial of service 2026-11-03T22:02:18.856237+00:00

Affected: RubyGems: crass

### Impact

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.

### Patches

This is fixed in Crass 1.0.7.

### Related

- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml