This backports the patch from 18135:561a9c25298e, addressing CVE-2021-43618 and ghc#22789 (closed).
18135:561a9c25298e