Uncontrolled Recursion Affecting crass package, versions <1.0.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-CRASS-17666965
- published29 Jun 2026
- disclosed28 Jun 2026
- creditRaka Hourianto
Introduced: 28 Jun 2026
New CVE NOT AVAILABLE CWE-674 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade crass to version 1.0.7 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Recursion when failing to apply :preserve_comments for a stylesheet containing a very large number of adjacent CSS comments. An attacker can cause a stack overflow and crash the application.