The CVE database can be quite problematic for libraries. CVEs get registered according to some 'worst case' impact criteria. This means that more often than not

The CVE database can be quite problematic for libraries. CVEs get registered according to some 'worst case' impact criteria. This means that more often than not, you the alerts go off for 'using the library in a stupid way' or 'using the library in an exotic/unusual way'. Often - not in this case - CVE descriptions are also poorly written, making it extremely difficult what kind of library use is the prerequisite for your product to be vulnerable. Stuff like this warrants a followup, but you have to have a good option in your vulnerability management to accept a vulnerable dependency (especially if - unlike this case - the upgrade path is not available or requires extensive other upgrades). In any case, casual high-rated CVEs for library edge cases like this contribute a lot to "alarm fatigue". Despite the CVE database being problematic for libraries, there's no real alternative for answering the question "do my dependencies have security problems?", so you've got to accomodate.