I contacted upstream a few days ago: https://varnish-cache.org/lists/pipermail/varnish-misc/2020-April/026854.html No answer yet.
I'll probably ping the security contact (individual maintainers) in a bit and search some more on my own. Failing that I'll mark the issue undetermined for 4.x. Cheers! Sylvain
