crass vulnerabilities

1 known vulnerability in crass from Rgrove. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.9 High severity

  crass: Memory Allocation with Excessive Size Value

  CVE-2026-61845Oct 30, 2026Rgrove

  Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use