it might be a failure to read on my part but this reads as unfixed on Debian but fixed on Arch

Edit: Oh, yeah ok, in the security repo it’s fixed, why is the vulnerable version distributed to stable though?