CVEs are frequently created for minor issues, like the recent Jackson bug that has very specific (and not frequent) case.