Crass is a Ruby CSS parser compliant with the CSS Syntax Level 3 specification. Multiple vulnerabilities affect versions prior to 1.0.8, including improper handling of escaped characters in URLs that may allow CSS-based UI redress or data exfiltration, recursive parsing without depth limits causing stack overflow or excessive memory use, excessive recursion triggered by many adjacent comments leading to denial of service, and inefficient parsing of non-ASCII characters causing high CPU usage and potential denial of service. These issues are fixed in versions 1.0.7 and 1.0.8.