There's an upcoming talk at the OpenSSL conference next month on the cost of bogus CVEs to open-source projects that covers similar ground. It also lists some particularly ridiculous CVEs that, despite being jawdroppingly stupid, still need to be responded to by project maintainers who really have better things to do with their lives.