CVE-2026-61845: 
Ruby vulnerability analysis and mitigation

CVE-2026-61845 is a denial-of-service vulnerability in Crass, a Ruby CSS parser gem, caused by unbounded exponentiation when processing CSS scientific notation number values. Crass computes 10**exponent before clamping the result to Float::MAX, allowing a tiny crafted CSS input to consume disproportionate CPU and memory, potentially crashing the application. All versions of the crass RubyGem prior to 1.0.7 are affected. The vulnerability was originally published on June 25, 2026, and added to the GitHub Advisory Database on October 20, 2026. It carries a CVSS v4 base score of 8.9 (High) (GitHub Advisory, Crass Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion/unbounded computation): Crass's CSS tokenizer evaluates scientific notation numbers (e.g., 1e999999999) by computing 10**exponent as an arbitrary-precision Ruby integer before clamping the result to Float::MAX. This unbounded exponentiation can require enormous CPU cycles and memory allocations for even a small input string. The fix in v1.0.7 bounds the exponent value before performing the computation, preventing runaway resource consumption. No authentication or special privileges are required — any application that passes attacker-controlled CSS strings to Crass's parser is vulnerable (GitHub Advisory, Crass Release).

Successful exploitation results in a denial-of-service condition affecting the availability of the vulnerable application and any downstream systems that depend on it. An unauthenticated remote attacker can craft a minimal CSS payload containing a large numeric exponent that forces the server to exhaust CPU and memory resources, potentially causing a crash or severe performance degradation. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue (GitHub Advisory, Crass Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The CVE status is listed as "Reserved," and there is no CISA KEV catalog entry or known threat actor attribution. The attack requires no privileges or user interaction, but does require that the target application pass attacker-controlled CSS input to Crass, which is noted as an "Attack Requirements: Present" condition in the CVSS v4 scoring (GitHub Advisory, Feedly).

1. Identify target: Locate a web application or service that uses the crass RubyGem (versions < 1.0.7) to parse CSS input supplied by users or external sources (e.g., user-submitted stylesheets, CSS sanitization pipelines).
2. Craft malicious CSS payload: Construct a CSS string containing a number in scientific notation with an extremely large exponent, such as a { width: 1e999999999; }. The payload can be very small in size.
3. Submit payload: Deliver the crafted CSS string to the application through any input vector that results in Crass parsing it — for example, a file upload endpoint, a CSS-in-HTML field, or an API accepting style data.
4. Trigger resource exhaustion: Crass attempts to compute 10**999999999 as an arbitrary-precision integer before clamping, consuming all available CPU and memory on the server, potentially causing a crash or making the service unresponsive (GitHub Advisory, Crass Release).

• Logs: Sudden spike in request processing time for endpoints that accept CSS input; application logs showing Ruby process crashes or out-of-memory errors (e.g., NoMemoryError, Errno::ENOMEM) correlated with CSS parsing operations.
• Process: Ruby worker processes consuming 100% CPU or exhausting available memory; processes killed by the OS OOM killer shortly after receiving a small CSS input.
• Network: Repeated small HTTP requests (potentially just a few hundred bytes) to CSS-accepting endpoints from the same source IP, each causing significant server-side resource consumption.

The vulnerability is fixed in Crass version 1.0.7, which bounds exponents before computing 10**exponent. Operators should update the crass gem to >= 1.0.7 immediately by running bundle update crass and redeploying the application. No configuration-based workaround is available for unpatched versions; the only effective mitigation is upgrading. Applications that do not pass attacker-controlled CSS to Crass are not at risk (GitHub Advisory, Crass Release, RubyGems).