Thanks for maintaining telnet.

  The bug was reported on a public mailing list, which is sadly common nowadays

In defence of the reporter, your Readme only says "Send bug reports to [email protected].", there is no distinction for vulnerabilities. [1]

There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26

One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose.

[1]: https://codeberg.org/inetutils/inetutils/src/commit/40f19d84...