PT-2026-84130 · Crates.Io · Manzana

Published

2026-04-07

·

Updated

2026-04-07

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The manzana crate appears to be a work-in-progress module for the Apple Silicon chips' features, including the Secure Enclave.
This crate's description and READMEs make no hint at the fact that the [SecureEnclaveSigner](https://docs.rs/manzana/0.2.0/manzana/secure enclave/struct.SecureEnclaveSigner.html) type is a stubbed implementation that does not actually perform any cryptographic operations, and instead returns fixed values.
Unsuspecting users of the crate, who may not check the source code, receive no warning about this and may believe they are using a secure implementation when they are not.
There are currently (as of 2026-04-07) no versions of the crate that contain either a real implementation, or a warning about the stubbed cryptography.
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

RUSTSEC-2026-0273

Affected Products

Manzana