Probably because mitre take days to weeks to give out CVE numbers (if ever). Just get the fix out there.