Isn’t gh-109638 a security problem? Doesn’t it deserve a CVE?

When looking the pull request gh-154867 (fix for gh-98820, CVE-2026-18503), I saw just next PR gh-154868 (fix for gh-109638), which however doesn’t have CVE. Shouldn’t it? It is exactly same DoS problem as the other one, isn’t it? Matěj