---
id: CVE-2026-61845
aliases:
  - GHSA-6wmf-3r64-vcwv
title: 'Crass : Large numeric exponents cause CPU and memory denial of service'
summary: 'Crass : Large numeric exponents cause CPU and memory denial of service'
severity: high
cwe:
  - CWE-674
vendor: crass
product: crass
ecosystem: rubygems
affected:
  - crass < 1.0.7
patched:
  - crass 1.0.7
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T14:32:40Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6wmf-3r64-vcwv'
references:
  - url: 'https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv'
  - url: 'https://github.com/rgrove/crass/releases/tag/v1.0.7'
  - url: >-
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
  - url: 'https://rubygems.org/gems/crass/versions/1.0.7'
  - url: 'https://github.com/advisories/GHSA-6wmf-3r64-vcwv'
tags:
  - ghsa
  - rubygems
ingestedAt: '2026-10-20T15:09:24.108Z'
---

## Overview

### Impact

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.

### Patches

This is fixed in Crass 1.0.7.

### Related

- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml

## Affected packages

- `crass < 1.0.7`

## Remediation

Upgrade to a patched release:

- `crass 1.0.7`