Two latest incompatible releases (e.g. 2.0.0 and 1.9.0).

Latest release gets all bug fixes, features, etc. Previous incompatible release gets security fixes and fixes for problems that render software completely unusable in certain configurations with no workaround.

If you believe the vulnerabilitiy does have a big impact on existing deployments - email fox.cpp at disroot.org, put "[maddy security]" in the Subject.

Otherwise, open a public issue.