Two weeks ago I reported a vulnerability to a security mailing list of a large open source software organization. I provided details of how to reproduce the issue and the exact place in the code where the bug causing the vulneratility is. So far I didn't get any response on that yet. I also wrote to one of the main developers asking if he was made aware of the issue. So far there was also no response from him.
The component the vulnerability is about hasn't been released for years, though there is still some developement going on and it is still widely used.
Is it normal for feedback to take that long? What shall I do about it?