I was discussing with @mcollina that we probably misjudged CVE-2026-21637, on a second look it doesn't look like a vulnerability, rather than a bug. The user responsibility is to not throw in that event handler, it's user code so outside of our threat model.

If revoking CVEs is a thing, I suggest we do that so users can adjust their expectations.