I think the bigger issue is when people rate ReDoS as higher severity than code execution vulns.

But ultimately, vuln lists are just lists not magic. You still have to apply them to your context.