Security Operations
Threat Intelligence
๐Ÿ”Ž
โ“

GHSA-6wmf-3r64-vcwv - Crass : Large numeric exponents cause CPU and memory denial of service

### Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. ### Patches This is fixed in Crass 1.0.7. ### Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
HIGH
Severity & confidence
Source severityhigh
Platform severityhigh
Confidencemedium
Exploitationunknown
CVSS-
Affected
Vendorscrass
Productscrass
Reporting sources (1)
GitHub Security Advisories
Open source โ†—
Timeline & provenance
Published2026-10-20T14:32:39
Last updated2026-10-21T08:56:06
Ingested2026-10-20T14:46:24
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
  1. Identify affected systems in your environment.
  2. Apply the vendor patch or mitigation guidance.
  3. Review logs for indicators described in the advisory.
  4. Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a single or secondary source; treat as indicative, verify before acting.
Source type: vendor ยท Original: GitHub Security Advisories