It was fixed, but not (publicly) recognized as a security issue, so likely not backported + updated by distros in "stable" channels.