(In reply to Greg Freemyer from comment #3) Thanks for the explanation. In this case I would suggest you either close this as wontfix (okay for us since it's only a DoS and not easy to trigger) or tag it as VUL-2 to indicate that it probably won't get fixed.