Comment by philipwhiuk

If this is a vulnerability every bug in every API is a vulnerability.

This is very spacebar-heating.

It's not a vulnerability, it's a bug. A system that used this bug in a way that relied on it to perform a security task would have a vulnerability.

We need to stop seeing library functions that are not themselves security systems as having vulnerabilities.