IT just reverted the changes to the redirection: http://www.hibernate.org/dtd/* once again redirects to http://hibernate.org/dtd/*, instead of https://hibernate.org/dtd/*. So the Xerces bug should not be triggered anymore.
To anybody reading this, be aware that we will eventually phase out HTTP and put redirections to HTTPS everywhere. Thus, I advise you to follow the suggestion in the post just above.