Many vendors do it, but on a set schedule "patch Tuesday" and some will release vague "mitigation steps" but honestly those usually come with the patch.

Yes, it's pretty common with large open source projects in the server space. Makes sense when releasing a fix also means releasing information that will let others exploit the bug so users need to be prepared to install the update quickly or take other measures to protect themselves.