CVE-2026-61847

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted stylesheet containing a large number of adjacent comments. Because the parser recursively processes comments when discarding them, handling these consecutive comments triggers excessiv...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in scanner.rb. An attacker can cause a stack overflow and crash the application by supplying CSS input containing numerous adjacent comments. Remediation Upgrade crass to version 1.0.7 or higher. References -...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion when failing to apply :preservecomments for a stylesheet containing a very large number of adjacent CSS comments. An attacker can cause a stack overflow and crash the application. Remediation Upgrade crass to...