Crass CVE-2026-61846

Exploitation requires that the embedding application pass attacker-controlled CSS (or content containing CSS, such as user-submitted HTML cleaned via Sanitize) into Crass's parser on a version prior to 1.0.7, where no nesting depth guard exists by default. The trigger is specifically input with simple blocks or functions nested far more deeply than legitimate CSS requires. Limiting factors: the flaw is not reachable if the application never parses untrusted CSS; it is mitigated if the application already wraps Crass calls in SystemStackError handling; and on patched (>= 1.0.7) deployments the default :maximum_depth of 25 discards over-deep constructs as an :error node, so only explicitly raising :maximum_depth reintroduces risk.

This is a moderate-severity availability issue, not a high-urgency emergency. No CVSS score or vector is provided by any source, so severity must be assessed independently; the vendor's own HISTORY.md rates it 'Moderate'. There is no EPSS score, no CISA KEV listing, and no PoC/exploit reference in the input, so this is not confirmed actively exploited and no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month' (not act_now or emergency), which is consistent with a denial-of-service-only flaw (CWE-400) that cannot yield code execution, data disclosure, or integrity loss. The real-world risk is genuinely gated by deployment: Crass is a library, so exploitability depends on whether the embedding application feeds attacker-controlled CSS into the parser (a common pattern when Crass is used transitively via the Sanitize gem to clean user-submitted HTML/CSS). Where that pattern exists and no SystemStackError rescue is present, a single crafted input can crash a request worker; where untrusted CSS is never parsed, practical risk is negligible. Note the absence of any CVSS vector in the input means the attack-vector and privilege characterization below is inferred from the description and typical usage, not confirmed by a scoring authority.

An attacker submits a value containing many deeply nested CSS simple blocks or functions (e.g. thousands of nested '{' or '(' delimiters) to an application that parses untrusted CSS with Crass - for instance an HTML/CSS sanitization path. Crass recurses without a depth guard until Ruby raises SystemStackError 'stack level too deep' or consumes excessive memory, disrupting the handling request or worker. No public exploit is identified at time of analysis, though crafting the triggering input is trivial.