Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 Crass, Non-ASCII characters cause superlinear CPU consumption, #CVE-2026-61848 (Moderate severity) -DC-Oct2026-3953 https://dailycve.com/crass-non-ascii-characters-cause-superlinear-cpu-consumption-cve-2026-61848-moderate-severity-dc-oct2026-3953/