[1.4.x] Don't characterize XML vulnerabilities as DoS-only.