The relevant issues:

- https://github.com/upx/upx/issues/146
- https://github.com/upx/upx/pull/190

Both CVEs were rejected, so I guess there is no need to include a patch.

-- 
Pierre Neidhardt