GHSA-6wmf-3r64-vcwv

Suggest an improvement
Source
https://github.com/advisories/GHSA-6wmf-3r64-vcwv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6wmf-3r64-vcwv/GHSA-6wmf-3r64-vcwv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6wmf-3r64-vcwv
Aliases
  • CVE-2026-61845
Downstream
CGA (47)
Published
2026-10-20T14:32:39Z
Modified
2026-10-20T14:45:03Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
Crass : Large numeric exponents cause CPU and memory denial of service
Details

Impact

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.

Patches

This is fixed in Crass 1.0.7.

Related

Database specific 
{
    "cwe_ids":  [
        "CWE-674"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-20T14:32:39Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

RubyGems / crass

Package

Name
crass
Purl
pkg:gem/crass

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.7

Affected versions

0.*
0.0.1
0.0.2
0.1.0
0.2.0
0.2.1
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6wmf-3r64-vcwv/GHSA-6wmf-3r64-vcwv.json"