Crass is a Ruby CSS parser that, before version 1.0.7, discards CSS comments by recursively consuming the next token. When presented with a stylesheet that contains a very large number of adjacent comments, the parser performs excessive recursion and triggers a SystemStackError, which causes the host application to crash. This flaw results in a denial of service condition for any process that processes untrusted CSS with Crass without comment preservation. The weakness is an instance of uncontrolled recursion (CWE-674). The likely attack vector is an attacker supplying a stylesheet that contains many adjacent comments to the parser.

The vulnerability affects the Ruby library Crass supplied by the vendor rgrove. Any Ruby application that uses Crass with a version earlier than 1.0.7 and does not enable the :preserve_comments option is impacted. Upgrading to 1.0.7 or newer removes the problem, as the parser no longer uses the recursive comment consumption path.

The CVSS score of 6.3 indicates moderate severity. An EPSS score is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalogue. The attack is inferable from the description: an attacker can trigger the denial of service by injecting a stylesheet with a large number of comments into any application that parses CSS with Crass without comment preservation. Because the flaw can be triggered by any untrusted CSS input, an attacker who can provide such input has a direct path to cause a SystemStackError and bring the application down. The defense is to upgrade to the patched version or enable the :preserve_comments option. While no exploit has been reported publicly, the moderate CVSS score and lack of evidence of widespread exploitation suggest the risk is significant but not immediate.