SZB-c5a59fea11
EUVD-2026-114321 reports unbounded exponent handling in Ruby crass gem before 1.0.7
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Crass
- Product
- crass
- First seen
Summary
The EUVD listing says that before version 1.0.7, the Ruby CSS parser crass converts scientific-notation numbers with unbounded exponentiation before clamping to Float::MAX. It assigns a CVSS v3.1 score of 8.9.
If you use Crass
Upgrade the crass gem to version 1.0.7 or later
Update applications that depend on crass through their Gemfile.lock
Limit CSS input from untrusted sources until upgraded
What the sources say 1
· Mastodon: “Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`.” Source