CVEs are not what they once (ever?) where. With the proliferation of automated systems involved with vulnerability management and dependency updates, it’s possible for a single GitHub PR close event to create a CVE for an issue that verifiably, 100% does not actually exist[1].

Interesting times ahead.

1. https://tomforb.es/cve-2022-0329-and-the-problems-with-autom...