Vulnerability not fixed by upstream maintainer in desired timeframe