The language is not why there are CVEs. They assign CVEs to most patches. Watch this talk by one of the maintainers to understand it: https://www.youtube.com/watch?v=NnV_cWeoo5Q