Crass versions prior to 1.0.7 have a vulnerability where parsing input containing non-ASCII characters leads to superlinear CPU consumption due to inefficient tracking of multi-byte character positions. This can be exploited by an attacker to cause excessive CPU usage and potential denial of service. The issue is fixed in version 1.0.7.