If the software is packaged in the big distros, you should feel free to go to their security teams and report it there. They can do the fix directly if the mai

If the software is packaged in the big distros, you should feel free to go to their security teams and report it there. They can do the fix directly if the maintainers are truly MIA, and they may have the ability to get in touch with people easier than you will alone. If the vulnerability is really severe, you could also report it to US-CERT; they can walk it through the coordination process for you, even anonymously.