GHSA-6jxj-px6v-747w - Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
### Impact
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage.
### Patches
This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default.
### Workarounds
Add `SystemStackError` handling around Crass calls in your application. Buy more RAM.
MEDIUM
Severity & confidence
Source severitymedium
Platform severitymedium
Confidenceconfirmed
Exploitationunknown
CVSS-
Affected
VendorscrassRed Hat
Productscrass
Reporting sources (3)
GitHub Security Advisories
Red Hat - CVE Feed
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-29T16:35:16
Last updated2026-11-04T16:08:11
Ingested2026-10-29T16:43:21
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
This object is reported by 3 independent sources.
Source type: vendor ยท Original: GitHub Security Advisories