> It's okay to have a little stack overflow as a treat? They're still doing a CVE and publishing a fix, they're just calling it HIGH and not CRITICAL (definiti

> It's okay to have a little stack overflow as a treat? They're still doing a CVE and publishing a fix, they're just calling it HIGH and not CRITICAL (definition at https://www.openssl.org/policies/general/security-policy.html https://www.openssl.org/policies/general/security-policy.htm...). More on their categorization, from when they decided to break CRITICAL out of HIGH: https://www.openssl.org/blog/blog/2015/09/28/critical-security-level/ https://www.openssl.org/blog/blog/2015/09/28/critical-securi...