CVE-2026-61848: falha de média gravidade em rgrove crass
Crass: Non-ASCII characters cause superlinear CPU consumption
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.5%
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Produtos afetados
rgrove · crassCVEs relacionadas — rgrove crass
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61847MEDIUMCrass: A large number of adjacent CSS comments can trigger a SystemStackErrorEPSS 0.5%CVE-2026-61846MEDIUMCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageEPSS 0.5%CVE-2026-61845HIGHCrass: Large numeric exponents cause CPU and memory denial of serviceEPSS 0.4%CVE-2026-116695MEDIUMCrass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassEPSS 0.4%