We build stalwart binary from scratch using the source code and internally we use osv-scanner to scan our applications.
The following are being reported for stalwart(there were many more which i fixed by either upgrading manually or removing dependency) which i can’t seem to fix because its either unmaintained or doesn’t have an upgrade.
I want to understand why do we still use unmaintained libs and if there is a plan to work on this.
Just want to understand where we are at about these
root@m:/apps/zabbix-agent/modules/vuls-scanner# ./scan-packages.sh
Scanning dir /apps
Starting filesystem walk for root: /
Let me look up information about Stalwart’s dependencies and security practices.
Your post was cut off before the actual vulnerability list was included, so the specific CVEs/advisories you’re seeing couldn’t be evaluated. That said, here is what is relevant to your situation:
Dependency vulnerabilities flagged by osv-scanner that cannot be fixed by upgrading are a known challenge in the Rust ecosystem. The Stalwart project runs cargo audit as part of its CI/CD pipeline and tracks dependency security actively. However, some advisories in the RustSec database are for unmaintained crates (RUSTSEC-XXXX-XXXX “unmaintained” class) and do not represent actual exploitable issues in the context of Stalwart’s usage.
Here is the recommended path forward:
Report the specific advisories to the Stalwart security team at [email protected]. Include the OSV IDs, affected crates, and whether you believe the vulnerable code path is reachable in Stalwart’s usage. The team commits to acknowledgment within 24 hours and a detailed response within 72 hours.
Check the GitHub Security Advisories tab on the Stalwart repository for any advisories that may already address what you are seeing.
Distinguish “unmaintained” from “vulnerable” – osv-scanner will flag crates marked as unmaintained in the RustSec DB (e.g., RUSTSEC-XXXX-XXXX). These are informational warnings, not confirmed exploits, and the Stalwart team evaluates whether replacement is feasible and safe.
Could you edit your post (or reply here) with the actual list of OSV/CVE IDs you are seeing? That would allow community members with Rust dependency expertise to comment on whether each one represents a real risk in Stalwart’s context, and the Stalwart maintainers can respond to actionable items.
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.
We build stalwart binary from scratch using the source code and internally we use osv-scanner to scan our applications.
The following are being reported for stalwart(there were many more which i fixed by either upgrading manually or removing dependency) which i can’t seem to fix because its either unmaintained or doesn’t have an upgrade.
I want to understand why do we still use unmaintained libs and if there is a plan to work on this.
Just want to understand where we are at about these
root@m:/apps/zabbix-agent/modules/vuls-scanner# ./scan-packages.sh
Scanning dir /apps
Starting filesystem walk for root: /
bincode | N/A | RUSTSEC-2025-0141 | LINK | /apps/npmail/stalwart-main/Cargo.lock
opentelemetry_sdk | CVE-2026-48504 | GHSA-w9wp-h8wv-79jx | LINK | /apps/npmail/stalwart-main/Cargo.lock
proc-macro-error2 | N/A | RUSTSEC-2026-0173 | LINK | /apps/npmail/stalwart-main/Cargo.lock
rsa | CVE-2023-49092 | RUSTSEC-2023-0071 | LINK | /apps/npmail/stalwart-main/Cargo.lock
rustls-pemfile | N/A | RUSTSEC-2025-0134 | LINK | /apps/npmail/stalwart-main/Cargo.lock