Multiple security vulnerabilities affect rubygem-crass, a Ruby CSS parser compliant with CSS Syntax Level 3. Prior to version 1.0.8, Crass incorrectly handles closing parentheses after escaped backslashes in bad URLs, potentially allowing CSS-based UI redress or data exfiltration, though not script execution. Versions before 1.0.7 suffer from unbounded recursion in parsing nested CSS blocks and functions, leading to denial of service via stack overflow or excessive memory use. Additionally, recursive comment parsing and inefficient handling of non-ASCII characters can cause excessive CPU consumption or crashes. These issues are fixed in versions 1.0.7 and 1.0.8.