Fixes go into a patch release of the newest minor version, which is the only version supported.

Report it privately, through GitHub's private vulnerability reporting, not in a public issue. Say which version you used, what input or call shows the problem, and what it lets an attacker do.

The maintainers answer in the advisory and work on the fix there. A fix is released with a GitHub security advisory, which the Go vulnerability database takes up, so that govulncheck reports the affected versions.