[1.3.x] Don't characterize XML vulnerabilities as DoS-only.