Hardened OpenResty image is less secure than standard image

Hi,

The GHI OpenResty image https://hub.docker.com/hardened-images/catalog/dhi/openresty/images/openresty%2Fdebian-13%2F1/sha256-bdf09c37c0a76f405ea1846fff33cf370f9083d90c9d94f04f05fb3663df1464/vulnerabilities is supposed to have 0 exploitable vulnerabilities but when scanning with Trivy (Aqua security), 16 crits and 18 highs resurface mostly around perl. Even when comparing with the "non-exploitable" vulnerabilities on GHI, Trivy spots a lot more vulnerabilities.

Here is the Trivy generated SBOM trivy-openresty-ghi-sbom.json

I think bumping the perl version could drastically improve the situation. Is that something that you guys have in mind ?