[sroussey]

Vendors often backport CVEs without changing version numbers.

[viraptor]

Or review the details and decide that the specific issue doesn't apply to them. This actually makes sense in larger environments.