Trivy scan reported several security issues

Questions
1

Your question

Trivy scan reported several security issues,

Select alert #12
Asymmetric Private Key
High
#12 opened 3 hours ago • Detected by Trivy in crates/…/task_manager/dkim.rs :617
main

Select alert #11
Asymmetric Private Key
High
#11 opened 3 hours ago • Detected by Trivy in crates/…/task_manager/dkim.rs :587
main

Select alert #10
Asymmetric Private Key
High
#10 opened 3 hours ago • Detected by Trivy in crates/…/network/webpush.rs :263
main

Select alert #9
Asymmetric Private Key
High
#9 opened 3 hours ago • Detected by Trivy in crates/…/network/webpush.rs :252
main

Select alert #8
Asymmetric Private Key
High
#8 opened 3 hours ago • Detected by Trivy in crates/…/network/webpush.rs :246
main

Select alert #7
Asymmetric Private Key
High
#7 opened 3 hours ago • Detected by Trivy in crates/…/network/webpush.rs :240
main

Select alert #6
Asymmetric Private Key
High
#6 opened 3 hours ago • Detected by Trivy in crates/…/config/mod.rs :196
main

Select alert #5
Asymmetric Private Key
High
#5 opened 3 hours ago • Detected by Trivy in crates/…/config/mod.rs :189
main

Select alert #4
Asymmetric Private Key
High
#4 opened 3 hours ago • Detected by Trivy in crates/…/config/mod.rs :183
main

Select alert #3
Asymmetric Private Key
High
#3 opened 3 hours ago • Detected by Trivy in crates/…/config/mod.rs :177
main

Select alert #1
lz4_flex: lz4_flex’s decompression can leak information from uninitialized memory or reused output buffer
High
#1 opened 3 hours ago • Detected by Trivy in Cargo.lock :4353
main

Select alert #2
Rand is unsound with a custom logger using rand::rng()
Low
#2 opened 3 hours ago • Detected by Trivy in Cargo.lock :6095

They work as expected? or they are vulns need to fix?

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

All of these are false positives triggered by Trivy’s generic secret-scanning pattern matching, not actual leaked keys or unpatched vulnerabilities.

The “Asymmetric Private Key” alerts (#3-#12): every one of these is a hardcoded test/example PEM key embedded in unit test code (dkim.rs, webpush.rs, config/mod.rs), used to test key parsing (RSA, EC/ECDSA, PKCS8, etc.). They’re not production secrets and never touch a live deployment; Trivy just pattern-matches any -----BEGIN ... PRIVATE KEY----- block regardless of context. These are safe to ignore or suppress in your scanner config.

#1 (lz4_flex uninitialized memory advisory): this is a transitive dependency pulled in via Cargo.lock, flagged for a known decompression issue in older lz4_flex versions. Whether it’s exploitable depends on whether lz4_flex is actually used to decompress untrusted input in Stalwart’s code paths, and whether the locked version is patched. Worth checking the current Cargo.lock version against the advisory’s fixed version.

#2 (rand unsound with custom logger): this is a Low-severity advisory about a specific misuse pattern (rand::rng() with a custom logger), also from a transitive dependency, not something Stalwart’s own code exercises directly.

None of this indicates an actively exploitable vulnerability from an operator’s perspective; the private-key alerts specifically are text fixtures, not credentials. If you want the dependency advisories addressed, worth flagging directly so someone can check the exact locked versions.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.