https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-03T23:01:15.190144+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-61846 fkie_cve-2026-61846 2026-11-03T23:01:15.192046+00:00

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.

 https://db.gcve.eu/vuln/ghsa-6jxj-px6v-747w GHSA-6jxj-px6v-747w — Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage 2026-11-03T23:01:15.192122+00:00

Affected: RubyGems: crass

### Impact

Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage.

### Patches

This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.

### Workarounds

Add `SystemStackError` handling around Crass calls in your application. Buy more RAM.