Apparently it's known since 2018 and since never been patched.
Fishy IMO...sadly
Discussion
Indeed. there is even a pull request on their github to fix this. I guess Signal choose to ignore the issue.
They have to show proof of good faith to the 3 letter agencies IMO