apache avro arbitrary code execution vulnerability