Crass: Non-ASCII characters cause superlinear CPU consumption

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Debian:12 ruby-crass1.0.2-3, 1.0.6-1, 1.0.7-1
• Debian:13 ruby-crass1.0.6-1, 1.0.7-1, 1.0.8-1
• Debian:14 ruby-crass0 → 1.0.7-1
• RubyGems crass0 → 1.0.7
• gem crassversion unspecified
• rubygems crass< 1.0.7

How to fix CVE-2026-61848

• Upgrade

  CVE-2026-61848 lists a fix boundary at 1.0.7-1. Compare the installed build with that boundary before you change production.

• Version check

  Affected < 1.0.7

• Advisory

  Open the cve_org record and follow its fix.

• Official advisories

  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • GitHub Advisory Database · github.com
  • GitLab Advisory Database · advisories.gitlab.com
  • OpenSSF OSV / OSV Scanner · osv.dev
  • OpenSSF OSV / OSV Scanner · osv.dev

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• crass · rubygems.org

Timeline

Detection, updates, and resolution for this record.

1. Oct 29, 2026 · GitHub Advisory Database

   Detected

   ### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service. ### Patches This is fixed in Crass 1.0.7. ### Workarounds Avoid passing non-ASCII

2. Oct 29, 2026 · GitHub Advisory Database

   Fix available

   crass fixed in 1.0.7

3. Oct 29, 2026 · GitHub Advisory Database

   Fix available

   crass fixed in 1.0.7

4. Oct 29, 2026 · GitHub Advisory Database

   Updated

   ### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service. ### Patches This is fixed in Crass 1.0.7. ### Workarounds Avoid passing non-ASCII

5. Oct 31, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   ruby-crass fixed in 1.0.7-1

6. Oct 31, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   ruby-crass fixed in 1.0.7-1

7. Oct 31, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   ### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service. ### Patches This is fixed in Crass 1.0.7. ### Workarounds Avoid passing non-ASCII

8. Oct 31, 2026 · Trivy Vulnerability DB

   Updated

   Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing , inefficiencies in tracking the positions of result in superlinear parsing time. An attacker-controlled CSS input consisting of many can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.

Sources

• CVE.orgVulnerability recordCVE-2026-61848

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-61848

  30-day exploitation probability 0.49%

  first.org
• GitHub Advisory DatabasePackage advisoryGHSA-8vfg-2r28-hvhj

  GitHub Advisory Database record mirrored by OSV.

  github.com
• GitLab Advisory DatabasePackage advisoryCVE-2026-61848

  When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.

  advisories.gitlab.com
• OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-61848
  osv.dev
• OpenSSF OSV / OSV ScannerPackage advisoryGHSA-8vfg-2r28-hvhj

  Crass: Non-ASCII characters cause superlinear CPU consumption

  osv.dev
• Red Hat Security DataVendor advisoryCVE-2026-61848

  crass: crass: Denial of Service via crafted non-ASCII CSS input

  access.redhat.com
• Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-61848

  Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing , inefficiencies in tracking the positions of result in superlinear parsing time. An attacker-controlled CSS input consisting of many ca

  osv.dev

References

• WEB · github.com
• GitHub reference · github.com
• PACKAGE · github.com
• WEB · github.com
• WEB · github.com
• ADVISORY · security-tracker.debian.org

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

• GitLab Advisory DatabaseNov 3, 2026
• GitHub Advisory DatabaseNov 2, 2026
• OpenSSF OSV / OSV ScannerNov 2, 2026
• Red Hat Security DataNov 1, 2026
• FIRST EPSSOct 31, 2026
• Trivy Vulnerability DBOct 31, 2026
• OpenSSF OSV / OSV ScannerOct 31, 2026
• CVE.orgOct 30, 2026