Microsoft’s Security Update Guide has published CVE-2026-32287 for an infinite loop condition in github.com/antchfx/xpath, the Go XPath package used by a long tail of tools that query XML, HTML, and JSON content. That combination matters because parser bugs rarely stay confined to one app: once...