we backported the CVE-2017-* secfixes to 2.6-r7 CVE-2019-11555 was fixed in 2.7-r3 ref #11914
mentioned in issue #11914 (closed)