CVE-2026-61847: 
Ruby vulnerability analysis and mitigation

CVE-2026-61847 is an uncontrolled recursion vulnerability in the Crass CSS parser (RubyGem) that allows a remote attacker to trigger a SystemStackError (stack overflow) by supplying a stylesheet containing a very large number of adjacent CSS comments. It affects all Crass versions prior to 1.0.7 and is exploitable only when the :preserve_comments option is disabled, which is the default behavior. The vulnerability was originally published by maintainer rgrove on June 25, 2026, and added to the GitHub Advisory Database on October 29, 2026. It carries a CVSS v4 base score of 6.3 (Medium) (GitHub Advisory, Crass Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion). In the affected versions, the consume method in lib/crass/tokenizer.rb handles discarded CSS comments by recursively calling itself to consume the next token; each adjacent comment adds one stack frame, and a sufficiently long sequence (empirically observed crash threshold around 12,000 comments) exhausts the Ruby call stack and raises a SystemStackError. The fix in commit 25d78cc replaces the recursive call with an iterative loop construct, eliminating the stack growth entirely. No authentication or special privileges are required — an attacker only needs to be able to supply a CSS stylesheet to an application that parses it with Crass using default settings (GitHub Advisory, Fix Commit).

Successful exploitation causes the Ruby process parsing the malicious stylesheet to crash with a SystemStackError, resulting in a denial of service for the affected application. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Applications that process untrusted user-supplied CSS (e.g., web applications accepting custom stylesheets or themes) are most at risk, and repeated exploitation could keep a service unavailable (GitHub Advisory, Crass Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-61847. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution is available. Exploitation is straightforward in concept — crafting a payload requires only generating a CSS string with thousands of adjacent /**/ comment tokens — but requires the attacker to control input to a Crass-parsing endpoint (GitHub Advisory).

1. Identify target: Locate a web application or service that uses the Crass RubyGem (versions < 1.0.7) to parse user-supplied CSS stylesheets, with the default :preserve_comments option (i.e., comments are discarded).
2. Craft malicious payload: Generate a CSS string consisting of a very large number of adjacent empty comments, well above the ~12,000-comment crash threshold. For example: '/**/' * 50_000.
3. Submit payload: Deliver the crafted CSS to the target application via any input vector that triggers Crass parsing — such as a stylesheet upload form, a CSS customization field, or an API endpoint.
4. Trigger stack overflow: The Crass tokenizer recursively calls consume for each adjacent comment, exhausting the Ruby call stack and raising a SystemStackError, crashing the parsing process and causing a denial of service (GitHub Advisory, Fix Commit).

• Logs: Ruby application logs showing SystemStackError exceptions originating from crass/tokenizer.rb in the consume method stack trace.
• Logs: Repeated application crashes or worker restarts correlated with CSS parsing requests.
• Network: HTTP requests submitting unusually large CSS payloads (potentially tens of kilobytes of repeated /**/ sequences) to stylesheet-processing endpoints.
• Process: Ruby worker processes terminating unexpectedly or being restarted by a process supervisor (e.g., Puma, Unicorn, Sidekiq) shortly after receiving CSS input.

Upgrade Crass to version 1.0.7 or later, which replaces the recursive comment-discarding logic with an iterative approach, fully resolving the vulnerability (Crass Release). As an immediate workaround without upgrading, set the :preserve_comments option to true when invoking the parser — this prevents the recursive code path from being triggered, though it changes parsing behavior by retaining comments in the output (Crass Advisory). Applications that do not process untrusted CSS input are not at risk.