Crass is a Ruby CSS parser that, before version 1.0.7, converted scientific‑notation numeric values using unbounded exponentiation before limiting the result to Float::MAX. An attacker can craft a tiny CSS snippet with a very large exponent that forces the parser to perform an exhaustive calculation, consuming excessive CPU cycles and memory. The result is a denial‑of‑service that can crash the host application. This flaw is identified as a CWE‑789 Resource Exhaustion vulnerability.

The vulnerability affects the Crass CSS parser maintained by rgrove. Any application that incorporates Crass versions older than 1.0.7 is at risk. This includes Ruby 2.x or 3.x projects that use Crass for parsing attacker‑controlled stylesheets or inline CSS.

The CVSS score of 8.9 indicates a high‑severity condition, and the vulnerability is considered exploit‑critical from the perspective of impact. EPSS is not available, but the flaw does not rely on privilege escalation or authentication; it can be triggered by any crafted CSS that reaches the parser. The likely attack vector is remote, via web pages, stylesheets, or other input channels that a malicious user can control. Although no KEV listing exists, the high severity and lack of mitigation make it prudent to treat it as a serious threat.