oscap oval xsltproc takes too much CPU (45+ minutes)

When running

$ cd /var/ossec
$ time oscap oval eval --results /tmp/r.out --verbose-log-file /tmp/r.log --verbose DEVEL /var/ossec/wodles/oscap/content/cve-debian-9-oval.xml
real	1m48.502s
user	1m42.148s
sys	0m5.540s
$ ls -lh /tmp/r.*
-rw-r--r-- 1 root root 47M Jan 13 20:25 /tmp/r.log
-rw-r--r-- 1 root root 41M Jan 13 20:25 /tmp/r.out
$ time xsltproc wodles/oscap/template_oval.xsl /tmp/r.out
real	45m9.351s
user	44m42.728s
sys	0m0.728s

The whole time xsltproc takes one core 100%:

26388 root      20   0  451508 383572   5488 R 99.7 19.1  29:09.58 xsltproc wodles/oscap/template_oval.xsl

it also uses over 300MB of RSS and up to 1.2GB of RSS on the production gitlab-host.

ii  xsltproc                 1.1.29-2.1        amd64             XSLT 1.0 command line processor