Upstream has abandoned the project. There are fixes that have never been
applied upstream in debian/patches (which are incomplete, see #907426).

The only user in Debian is upx-ucl, which has a maintained fork at
https://github.com/upx/upx-vendor-ucl/tree/devel which has the essential
fixes.

Please switch to that fork as new upstream.