Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Manzana library returns fake signatures, not real encryption
published 7 months ago
Summary
The Manzana software component for Apple Silicon’s Secure Enclave claims to sign data but actually just returns preset values, providing no real security. If your applications rely on it, they may think information is protected when it isn’t. Replace it with a genuine cryptographic library or wait for an updated version that clearly warns about the placeholder code.
What to do
- Update noahgift manzana to version 0.3.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| crates.io | noahgift | manzana |
>= 0.0.0-0, < 0.3.0 Fix: upgrade to 0.3.0
|
Original advisory text
Stubbed cryptography without warnings
The `manzana` crate appears to be a work-in-progress module for the Apple Silicon chips' features, including the Secure Enclave.
This crate's description and `README`s make no hint at the fact that the [`SecureEnclaveSigner`](https://docs.rs/manzana/0.2.0/manzana/secure_enclave/struct.SecureEnclaveSigner.html) type is a stubbed implementation that does not actually perform any cryptographic operations, and instead returns fixed values.
Unsuspecting users of the crate, who may not check the source code, receive no warning about this and may believe they are using a secure implementation when they are not.
There are currently (as of `2026-04-07`) no versions of the crate that contain either a real implementation, or a warning about the stubbed cryptography.
This crate's description and `README`s make no hint at the fact that the [`SecureEnclaveSigner`](https://docs.rs/manzana/0.2.0/manzana/secure_enclave/struct.SecureEnclaveSigner.html) type is a stubbed implementation that does not actually perform any cryptographic operations, and instead returns fixed values.
Unsuspecting users of the crate, who may not check the source code, receive no warning about this and may believe they are using a secure implementation when they are not.
There are currently (as of `2026-04-07`) no versions of the crate that contain either a real implementation, or a warning about the stubbed cryptography.
References
- https://crates.io/crates/manzana Product
- https://rustsec.org/advisories/RUSTSEC-2026-0273.html Vendor Advisory
- https://github.com/paiml/manzana/issues/3 Third Party Advisory
- https://github.com/paiml/manzana/blob/89e3183ac38088d418a2edeb9d3e0f35133b27a3/R... URL
- https://github.com/paiml/manzana/blob/89e3183ac38088d418a2edeb9d3e0f35133b27a3/s... URL
- https://github.com/paiml/manzana/blob/89e3183ac38088d418a2edeb9d3e0f35133b27a3/s... URL
Timeline
Published7 Apr 2026
Updated9 Sep 2026
First seen9 Sep 2026
Sources
RUSTSEC-2026-0273 · OSV
Track software like this
Free during beta