Aha, I didn’t realize compromising availability was sufficient for the CVE definition of security vulnerability. Projects I’ve worked on have typically excluded availability, though that may not be the norm.

And I see your point about some exploits being highly asymmetric in the attacker’s favor, compared to classic [D]DoS.