Dude even backported the fix to his 5.6->8.0 branches

Newest: 5.6.40-104 which has the CVE fixes.