Collin Funk <[email protected]> writes: > ## Timeline > > 2026-07-02: Report sent to [email protected] > 2026-07-02: I (Collin Funk) acknowledged the report and asked a few > questions regarding the issue. > 2026-07-04: Tristan answered those questions. > 2026-07-06: I reproduced the issue updated Tristan with a planned > timeline for the fix and CVE assignment. > 2026-07-08: Tristan agreed to the timeline and offered to review the > patch. > 2026-07-11: I wrote the patch and sent it to Tristan. > 2026-07-15: Tristan confirmed the patch worked as expected. > 2026-07-16: Private mail to distros mailing list along with the patch. > 2026-07-24: I wrote this report and sent it to oss-security. > > Note that I also requested a CVE when emailing distros, but haven't > heard back. I'll probably reach out privately to a CNA in a bit, and > will update here once one is assigned.
Red Hat assigned CVE-2026-19720 to this issue yesterday, 2028-08-13. Collin
