HIGHCVSS not yet scoredVulnerability
CVE-2026-61845
### Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. ### Patches This is fixed in Crass 1.0.7. ### Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
Properties
- Ghsa id
- GHSA-6wmf-3r64-vcwv
- Severity
- high
- Summary
- Crass : Large numeric exponents cause CPU and memory denial of service
- Last source
- GitHub Advisory Database
- Cve id
- CVE-2026-61845
- First seen by Signal
- 2026-10-20T17:12:31+00:00
- Is ghsa only
- false
- Retrieved at
- 2026-10-21T01:23:59+00:00
- Ghsa published
- 2026-10-20T14:32:39Z
- Source url
- https://github.com/advisories/GHSA-6wmf-3r64-vcwv
- Ghsa updated
- 2026-10-20T14:32:40Z
Related Entities (3)
AFFECTS (1)
HAS_WEAKNESS (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph