Crass, a Ruby CSS parser, has an inefficiency that causes superlinear parsing time when handling CSS strings that contain many non‑ASCII, multi‑byte characters. This leads to excessive CPU consumption and can trigger a denial‑of‑service condition if an attacker supplies sufficiently large, crafted CSS input. The weakness is a resource‑consumption flaw identified by CWE‑400.

The Crass library for Ruby, version 1.0.6 and earlier, is vulnerable. Applications that import or parse untrusted CSS using these versions are impacted. The vendor product is rgrove:Crass.

The CVSS score of 6.3 indicates moderate severity. EPSS data is not provided, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is delivering large CSS payloads that include many non‑ASCII characters to the vulnerable parser, assuming the application allows arbitrary CSS input from external sources or has no size limits or rate limiting in place. The impact is a denial of service via CPU exhaustion.