connorskees grass up to 0.13.4 UTF-8 Character raw_to_parse_error denial of service

Summaryinfo

A vulnerability marked as problematic has been reported in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. The manipulation leads to denial of service. This vulnerability is listed as CVE-2026-14650. The attack must be carried out locally. In addition, an exploit is available. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

Detailsinfo

A vulnerability was found in connorskees grass up to 0.13.4. It has been rated as problematic. This issue affects the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-14650. The exploitation is known to be easy. Attacking locally is a requirement. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• connorskees

Name

• grass

Version

• 0.13.0
• 0.13.1
• 0.13.2
• 0.13.3
• 0.13.4

Website

• Product: https://github.com/connorskees/grass/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #846665: grass 0.13.4 Denial of Service (by Zyz3366)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion