CVE-2026-32287 Infinite loop in github.com/antchfx/xpath