Juraj Somorovsky reported that certain XML parsers/servers are affected by the same, or similar, flaw as the hash table collisions CPU usage denial of service. Sending a specially crafted message to an XML service can result in longer processing time, which could lead to a denial of service. It is reported that this attack on XML can be applied on different XML nodes (such as entities, element attributes, namespaces, various elements in the XML security, etc.). xmltex is written in TeX. xmltex appears to use the "group" array(ish) type to store XML elements however it is unclear if this is vulnerable, it needs investigation.
passivetex-1.25-11 uses xmltex
As a side note here, both - passivetex and xmltex packages are almost dead packages. No upstream, no future releases expected and now many upstream applications previously dependent on them started to use different things. Even the docbook stylesheets upstream plans to remove extra hacks for passivetex, so it is likely these packages will fade away soon.
I'm wontfixing this. This issue never really got confirmed, and even if it is confirmed, it's impact does not justify fixing.