Bug 2564247 (CVE-2026-61845)

Summary: CVE-2026-61845 crass: crass: Denial of Service via crafted scientific notation in CSS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akostadi, amasferr, anthomas, dmayorov, ehelms, eshamard, ggainey, jlledo, jpasqual, juwatts, jvasik, kaycoth, lblicha, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pantinor, pcreech, rblanco, rchan, smallamp, tmalecek, tsedmik, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in crass. A remote attacker can cause a Denial of Service (DoS) by submitting specially crafted Cascading Style Sheets (CSS) inputs containing scientific notation with excessively large exponents. Because crass calculates these exponent values without proper limits, processing the input can exhaust system CPU and memory resources, potentially causing the application to crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-30 19:09:19 UTC 
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.