I'd expect an experimental library to possibly be filled with bugs and constantly evolve (in a breaking way) its API while having a "USE AT YOUR OWN RISK" message. Although that might not be how the namespace golang.org/x/ is defined.

Looking here: https://golang.org/doc/go1compat

> may be developed under looser compatibility requirements

looks like that might explain why it's a CVE. Also another good answer from Zaki: https://twitter.com/zmanian/status/853342150272008192