{"id":"ghsa-ghsa-6wmf-3r64-vcwv","seq":2435,"kind":"advisory","title":"Crass : Large numeric exponents cause CPU and memory denial of service","url":"https://github.com/advisories/GHSA-6wmf-3r64-vcwv","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6wmf-3r64-vcwv","summary":"影響: rubygems:crass < 1.0.7 → 1.0.7\nImpact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. Patches This is fixed in Crass 1.0.7. Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml","severity":"high","techs":["ruby","github"],"cves":["CVE-2026-61845"],"tags":["GHSA-6wmf-3r64-vcwv","crass"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T14:32:39.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}