CVE-2026-31430 X.509: Fix out-of-bounds access when parsing extensions