# CVE-2026-61847: Crass CSS parser stack overflow via excessive comments

Source: https://junglewise.ai/threats/cve-2026-61847-crass-a-large-number-of-adjacent-css-comments-can-trigger-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-61847 · Severity: medium · CVSS 4 · Published 2026-10-30

Crass is a CSS parser library used by web applications to process stylesheets. When comment preservation is disabled (the default), the library recursively discards comments, and an attacker can crash the application by submitting a stylesheet with an extremely large number of adjacent comments, causing a stack overflow error and denying service to legitimate users.

Technologies: [Rgrove Crass](https://junglewise.ai/threats/technologies/rgrove-crass), [crass (RubyGems)](https://junglewise.ai/threats/technologies/crass). Vendors: [Rgrove](https://junglewise.ai/threats/vendors/rgrove), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-61847 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61847 being exploited in the wild.

**How severe is CVE-2026-61847?** Medium severity, with a CVSS score of 4, published 30 October 2026.

**Which products and versions are affected?** Rgrove Crass < 1.0.7; crass (RubyGems) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

**Is there a fix for CVE-2026-61847?** Yes. crass (RubyGems): upgrade to 1.0.7 or later. Until then: Set the `:preserve_comments` option to `true` if acceptable for your use case, as recursion does not occur when comments are preserved. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61847 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61847?** Check whether you run Rgrove Crass or crass (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- crass (RubyGems): upgrade to 1.0.7 or later

  ```sh
  bundle update crass
  ```


Set the `:preserve_comments` option to `true` if acceptable for your use case, as recursion does not occur when comments are preserved.

## Technical details

The vulnerability is an uncontrolled recursion flaw (CWE-674) in Crass's comment-handling logic. When the `:preserve_comments` option is false, the parser recursively consumes tokens to discard comments; a stylesheet with many adjacent comments triggers excessive recursion and a SystemStackError. The attack requires only network access to an application that processes untrusted CSS with default settings.

## Affected products

- rgrove Crass < 1.0.7

## Identifiers

- CVE-2026-61847
- GHSA-wwpr-jff3-395c

## Timeline

- 2026-10-29: disclosed
- 2026-10-29: advisory
- 2026-06-25: patched

## References

- [https://api.github.com/users/hourianto](https://api.github.com/users/hourianto)

## Related threats

- [Crass library non-ASCII character parsing DoS](https://junglewise.ai/threats/cve-2026-61848-crass-non-ascii-characters-cause-superlinear-cpu-consumption)
- [Crass CSS parser uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-61846-crass-deeply-nested-css-blocks-and-functions-can-trigger-a)
- [Crass CSS parser denial of service via large numeric exponents](https://junglewise.ai/threats/cve-2026-61845-crass-large-numeric-exponents-cause-cpu-and-memory-denial-of)
- [Crass CSS parser bad URL tokenizer bypass in sanitizers](https://junglewise.ai/threats/cve-2026-116695-crass-is-a-ruby-css-parser-that-is-compliant-with-the-css-syntax)