Crass parses CSS recursively without a depth guard until version 1.0.7. An input containing deeply nested blocks or functions causes Ruby to raise a SystemStackError or consume excessive memory, crashing the interpreter or exhausting system resources. This can terminate services that depend on the parser, leading to a denial of service. The weakness is an unchecked recurrence that fits CWE-674.

The vulnerability affects the Crass CSS parser delivered by rgrove. Any installation using Crass version 1.0.6 or earlier is vulnerable. Versions 1.0.7 and later contain a configurable depth limit that mitigates the issue.

The likely attack vector is an attacker delivering a malicious CSS value containing deeply nested blocks or functions. The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in CISA KEV, suggesting it may not be actively exploited yet. However, if an application accepts user‑supplied CSS that reaches Crass, the recursion can be triggered, causing Ruby to raise a SystemStackError or consume excessive memory, potentially crashing the interpreter or exhausting system resources. Because the parser lacks an explicit depth guard, an attacker can trigger the recursion by simply supplying an overly complex style sheet, making exploitation straightforward once the vulnerable parser is reached.