{"id":"CVE-2026-61845","aliases":["GHSA-6wmf-3r64-vcwv"],"title":"Crass : Large numeric exponents cause CPU and memory denial of service","summary":"Crass : Large numeric exponents cause CPU and memory denial of service","severity":"high","cwe":["CWE-674"],"vendor":"crass","product":"crass","ecosystem":"rubygems","affected":["crass < 1.0.7"],"patched":["crass 1.0.7"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T14:32:40Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6wmf-3r64-vcwv","references":[{"url":"https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv"},{"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml"},{"url":"https://rubygems.org/gems/crass/versions/1.0.7"},{"url":"https://github.com/advisories/GHSA-6wmf-3r64-vcwv"}],"tags":["ghsa","rubygems"],"ingestedAt":"2026-10-20T15:09:24.108Z","slug":"CVE-2026-61845","body":"## Overview\n\n### Impact\n\nCrass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.\n\n### Patches\n\nThis is fixed in Crass 1.0.7.\n\n### Related\n\n- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml\n\n## Affected packages\n\n- `crass < 1.0.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `crass 1.0.7`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}