Apparently someone made an oopsi and posted the vuln as issue https://github.com/apache/logging-log4j2/issues/4255