[feld]

Yes you can. You report it on oss-security mailing list and request a CVE and one will be assigned to you.