Now I can use any operating system I want without losing features.
Because attacker-supplied flow data is used in public flows, the bug leads to unauthenticated remote code execution.