Comment by rustyhancock

I think it's a good idea when there is no CVE and a don't fix status.

Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.