For a vulnerability of this magnitude, it's not unusual for a responsible disclosure to have a five month review window.

e.g. Dan Kaminsky's discovery of DNS cache poisoning had a 5 month responsible disclosure embargo.