SUSE CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...

SUSE CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

SUSE CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

Linux Distros Unpatched Vulnerability : CVE-2026-61845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number value...

Linux Distros Unpatched Vulnerability : CVE-2026-61848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII...

Linux Distros Unpatched Vulnerability : CVE-2026-61846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and...

Linux Distros Unpatched Vulnerability : CVE-2026-61847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled,...

CVE-2026-61846

A flaw was found in crass. The CSS parser is vulnerable to a Denial of Service DoS because it recursively processes simple blocks and functions without enforcing a depth limit. A remote attacker can supply a specially crafted CSS input containing deeply nested structures to trigger stack exhausti...

CVE-2026-61848

A flaw was found in crass. This vulnerability allows a remote attacker to cause a Denial of Service DoS through excessive CPU resource consumption. When parsing input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in disproportionately lo...

CVE-2026-61847

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted stylesheet containing a large number of adjacent comments. Because the parser recursively processes comments when discarding them, handling these consecutive comments triggers excessiv...

CVE-2026-61845

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting specially crafted Cascading Style Sheets CSS inputs containing scientific notation with excessively large exponents. Because crass calculates these exponent values without proper limits, processing the...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...