Cssom
Monthly
Denial of service in the CSSOM JavaScript library through 0.5.0 allows unauthenticated remote attackers to terminate a parsing process by supplying a stylesheet declaration named 'length', a reserved property name that is not validated and therefore overwrites the internal declaration counter; the corrupted counter then drives an oversized memory allocation when cssText is serialized, crashing the process. Exploitation is conditional rather than automatic: the host application must feed attacker-controlled CSS into CSSStyleDeclaration.setProperty() or stylesheet parsing and must later serialize that declaration via cssText, so deployments that only parse trusted first-party CSS, or that never serialize untrusted input, are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the provided CVSS 4.0 score of 8.7 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high availability-only impact with no confidentiality or integrity effect, and the library itself is not network-exposed.
Denial of service in the CSSOM JavaScript library through 0.5.0 allows unauthenticated remote attackers to terminate a parsing process by supplying a stylesheet declaration named 'length', a reserved property name that is not validated and therefore overwrites the internal declaration counter; the corrupted counter then drives an oversized memory allocation when cssText is serialized, crashing the process. Exploitation is conditional rather than automatic: the host application must feed attacker-controlled CSS into CSSStyleDeclaration.setProperty() or stylesheet parsing and must later serialize that declaration via cssText, so deployments that only parse trusted first-party CSS, or that never serialize untrusted input, are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the provided CVSS 4.0 score of 8.7 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high availability-only impact with no confidentiality or integrity effect, and the library itself is not network-exposed.