OpenSSH considers this to be a vulnerability in musl and not OpenSSH, but shipped a fix anyways since that helps mitigate impact... Whether you agree with that or not, it's up to you :)

Probably because mitre take days to weeks to give out CVE numbers (if ever). Just get the fix out there.