Crass CVE-2026-61845

Exploitation requires that the consuming application pass attacker-controlled CSS strings to Crass's parser (any code path that tokenizes/parses untrusted CSS, such as CSS sanitization of user input); the malicious input must contain a CSS number in scientific notation with a very large exponent. There is no authentication, user interaction, or special Crass configuration required by the library itself - the limiting factor is entirely whether the application exposes a CSS-parsing path to untrusted input. Applications that only parse trusted/static CSS are not realistically exposed. Affected versions are Crass < 1.0.7.

No CVSS vector, EPSS score, KEV listing, or public POC is provided in the input, so quantitative exploitation signals are entirely absent and cannot be compared or contrasted. The only authoritative severity signal is the vendor's own release note, which rates this a 'High' denial-of-service issue (CWE-674, uncontrolled resource consumption). On its own technical merits this is a genuine but bounded risk: Crass is a CSS parsing library, and the flaw is only reachable when an application feeds attacker-controlled CSS to the parser, where a tiny input (a large scientific-notation exponent) triggers unbounded 10**exponent computation before clamping to Float::MAX, consuming disproportionate CPU/memory and possibly crashing the process. This is an availability-only issue - there is no confirmed confidentiality or integrity impact. It is not confirmed as actively exploited (no public exploit identified at time of analysis), so despite the vendor 'High' rating this should be treated as a patch-promptly dependency-hygiene item rather than an emergency, weighted by how exposed the consuming application's CSS-parsing path is to untrusted input. Note: the absence of EPSS/KEV/POC reflects missing input data, not a verified low real-world interest level.

An attacker submits a small CSS string containing a numeric value in scientific notation with a very large exponent (e.g. a value like '1e99999999') to a web application that uses Crass to parse or sanitize user-supplied CSS. Crass evaluates 10**exponent before clamping to Float::MAX, so the single short input forces the server to spend disproportionate CPU and memory, degrading or crashing the process and denying service to other users. No public exploit code is identified at time of analysis, but the triggering input is trivial to construct from the public advisory description.