{"id":"CVE-2026-61848","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-61848","summary":"Crass: Non-ASCII characters cause superlinear CPU consumption","details":"### Impact\n\nWhen parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.\n\n### Patches\n\nThis is fixed in Crass 1.0.7.\n\n### Workarounds\n\nAvoid passing non-ASCII input to Crass. Or cultivate patience.","published":"2026-10-29T16:35:29Z","modified":"2026-10-29T16:45:04.487777722Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"crass","fixedVersion":"1.0.7"}],"fix":{"url":"http://github.com/rgrove/crass/commit/da29664648bf80a97a6439e030a4814291c9afa5","label":"rgrove/crass@da29664"},"references":[{"type":"WEB","url":"https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj"},{"type":"PACKAGE","url":"https://github.com/rgrove/crass"},{"type":"WEB","url":"https://github.com/rgrove/crass/releases/tag/v1.0.7"},{"type":"WEB","url":"http://github.com/rgrove/crass/commit/da29664648bf80a97a6439e030a4814291c9afa5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T16:45:04.487777722Z"}}