Re: ZDI-CAN-33367: New Vulnerability Report

[Peter Zijlstra]

On Thu, Oct 22, 2026 at 09:34:45PM +0200, Willy Tarreau wrote:
> > We will have some discussions internally, but in the meantime, we will send the cases to you as we always have.
> > If you don't want to do anything with it, that's fine too. We will release the findings at rejection, or 120 days.
> > Whichever comes first.
> 
> The main problem we're having is that it's not possible to have anyone on
> your side nor the reporter test a patch. But I won't rehash this, it's not
> new, but *this* is what makes your reports way more painful to deal with
> than many other ones. You (unvoluntarily it seems) act as an insulation
> layer between reporters and develoeprs and that really doesn't help.

This; Willy is far more eloquent than I am, but the zdi reports have
been very painful. And as said; this has been raised a fair number of
times.