Nice find, Hanno!
Too bad coordination with the Apache folks didn’t work out. How come, though?
I can only explain it as lack of communication.
I asked the apache team twice for a disclosure date and planned release. After that I set my own disclosure date, however with an offer that we could still agree on a coordinated disclosure, but only if they set a defined date, not for some undefined date in the future. That prompted a reply, but only that they now prepare a release, but still couldn’t define a date for it. So I went ahead, informed distros and one week later made it public.