CVE-2026-61846: 
Ruby vulnerability analysis and mitigation

CVE-2026-61846 is a denial-of-service vulnerability in the Crass CSS parser (RubyGems) caused by unbounded recursion when parsing deeply nested CSS simple blocks and functions. All versions of Crass prior to 1.0.7 are affected. The vulnerability was originally published on June 25, 2026, and added to the GitHub Advisory Database on October 29, 2026 under GHSA-6jxj-px6v-747w. It carries a CVSS v4 base score of 6.3 (Medium) (GitHub Advisory, Crass Advisory).

The root cause is uncontrolled resource consumption (CWE-400): Crass's parser recursively calls consume_simple_block and consume_function without any depth limit, meaning each nested CSS block or function adds a new stack frame. An attacker who can supply attacker-controlled CSS input (e.g., via a user-submitted stylesheet or style attribute) can craft input with hundreds or thousands of nested blocks, causing Ruby to raise SystemStackError: stack level too deep or exhausting available memory. The fix in commit cf68287 introduces a @depth counter and a configurable DEFAULT_MAXIMUM_DEPTH of 25; constructs exceeding this limit are discarded iteratively as :error nodes rather than recursed into (Crass Commit, GitHub Advisory).

Successful exploitation results in a denial-of-service condition affecting the availability of the Ruby application using Crass. An attacker can crash the parsing process via a SystemStackError or cause excessive memory consumption, potentially making the application unresponsive. There is no impact on confidentiality or integrity — the vulnerability is limited to availability of the vulnerable system and, to a lesser degree, any subsequent systems that depend on it (GitHub Advisory, Crass Advisory).

No public proof-of-concept exploit code, exploit kits, or in-the-wild exploitation have been reported for CVE-2026-61846. The CVE status remains "Reserved" and no EPSS score or CISA KEV catalog entry is currently associated with this vulnerability. Exploitation requires that the attacker can supply attacker-controlled CSS input to an application using a vulnerable version of Crass, which is a prerequisite that limits the attack surface (GitHub Advisory, Feedly).

1. Identify target: Locate a Ruby web application that accepts user-supplied CSS input (e.g., user-defined stylesheets, sanitized HTML with style attributes) and processes it with the Crass gem version < 1.0.7.
2. Craft malicious CSS payload: Construct a CSS string with deeply nested simple blocks or functions exceeding Ruby's default stack depth, for example: a{b{c{d{e{f{g{...}}}}}}} repeated hundreds of times, or equivalently using CSS functions: calc(calc(calc(calc(...)))).
3. Submit payload: Deliver the crafted CSS to the application via any input vector that triggers Crass parsing — such as a form field, API endpoint, or file upload that processes CSS.
4. Trigger denial of service: The Crass parser recursively descends into each nested block without a depth guard, eventually raising SystemStackError: stack level too deep or exhausting available memory, crashing or hanging the Ruby process (GitHub Advisory, Crass Commit).

• Logs: Ruby application logs showing SystemStackError: stack level too deep originating from within the crass gem's parser methods (consume_simple_block, consume_function, consume_component_value).
• Application Behavior: Sudden process crashes or unresponsiveness in Ruby services that process CSS input, particularly correlated with user-submitted content.
• Memory: Abnormal memory growth in the Ruby process prior to crash, observable via system monitoring tools (e.g., top, ps, APM agents), when processing specific CSS inputs.
• Network: Repeated requests containing CSS payloads with unusually high levels of bracket or parenthesis nesting submitted to endpoints that accept CSS or HTML with style attributes.

The primary remediation is to upgrade Crass to version 1.0.7 or later, which introduces a configurable maximum nesting depth (:maximum_depth option, defaulting to 25) that prevents unbounded recursion (Crass Release). As a short-term workaround, applications can wrap all Crass parsing calls in a rescue SystemStackError block to prevent process crashes, though this does not address memory exhaustion. Input validation to reject or truncate excessively nested CSS before it reaches the parser is also advisable (GitHub Advisory).