Seems slightly confusing that the OpenSSH release notes page says:

> This release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled.

But that there's nothing about it on their security page.

Even if it's not technically a bug in their code, the fact that they've made a "critical" release to address it suggests that it should probably be listed on the security page as well. But maybe (hopefully) they just haven't updated the security page yet.