RUSTSEC-2026-0273

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0273

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0273.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0273

Published

2026-04-07T12:00:00Z

Modified

2026-09-09T08:30:02Z

Summary

Stubbed cryptography without warnings

Details

The manzana crate appears to be a work-in-progress module for the Apple Silicon chips' features, including the Secure Enclave.

This crate's description and READMEs make no hint at the fact that the SecureEnclaveSigner type is a stubbed implementation that does not actually perform any cryptographic operations, and instead returns fixed values.

Unsuspecting users of the crate, who may not check the source code, receive no warning about this and may believe they are using a secure implementation when they are not.

There are currently (as of 2026-04-07) no versions of the crate that contain either a real implementation, or a warning about the stubbed cryptography.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / manzana

Package

Name: manzana; View open source insights on deps.dev
Purl: pkg:cargo/manzana

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "manzana::secure_enclave::SecureEnclaveSigner::create",
            "manzana::secure_enclave::SecureEnclaveSigner::delete",
            "manzana::secure_enclave::SecureEnclaveSigner::load",
            "manzana::secure_enclave::SecureEnclaveSigner::sign",
            "manzana::secure_enclave::SecureEnclaveSigner::verify"
        ],
        "os": [
            "macos"
        ]
    }
}