{"id":"OESA-2026-4726","summary":"rubygem-crass security update","details":"Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec.\r\n\r\nSecurity Fix(es):\n\nCrass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)\n\nCrass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)\n\nCrass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)\n\nCrass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)","modified":"2026-11-04T14:00:06.881129613Z","published":"2026-11-04T13:54:57Z","upstream":["CVE-2026-116695","CVE-2026-61846","CVE-2026-61847","CVE-2026-61848"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4726"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116695"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61846"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61847"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61848"}],"affected":[{"package":{"name":"rubygem-crass","ecosystem":"openEuler:24.03-LTS-SP1","purl":"pkg:rpm/openEuler/rubygem-crass&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["rubygem-crass-1.0.8-1.oe2403sp1.noarch.rpm","rubygem-crass-doc-1.0.8-1.oe2403sp1.noarch.rpm"],"src":["rubygem-crass-1.0.8-1.oe2403sp1.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4726.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}