Thanks for maintaining telnet. The bug was reported on a public mailing list, which is sadly common nowadays In defence of the reporter, your Readme only sa

Thanks for maintaining telnet. The bug was reported on a public mailing list, which is sadly common nowadays In defence of the reporter, your Readme only says "Send bug reports to bug-inetutils@gnu.org.", there is no distinction for vulnerabilities. [1] There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26 https://codeberg.org/inetutils/inetutils/pulls/26 One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose. [1]: https://codeberg.org/inetutils/inetutils/src/commit/40f19d84c3dead93e6fef7fc1150fde5210ebdab/README.md?display=source#L8 https://codeberg.org/inetutils/inetutils/src/commit/40f19d84...