Vulnerability reporting needs to be coordinated with the ASF Security Team, refer to the Reporting a vulnerability on details.