{"cve":"CVE-2026-31960","nvd":{"published":"2026-03-11T20:16:16.940","modified":"2026-06-17T10:34:50.700","status":"Analyzed","description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.3},"cwes":["CWE-770"],"references":["https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g"],"products":["anchore:quill"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-31960","score":0.00092,"percentile":0.00479,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-g32c-4pvp-769g","url":"https://osv.dev/vulnerability/GHSA-g32c-4pvp-769g","summary":"Quill has DoS via unbounded read of HTTP response body during notarization","modified":"2026-03-23T04:56:07.741560998Z","packages":[{"ecosystem":"Go","name":"github.com/anchore/quill","purl":"pkg:golang/github.com/anchore/quill","ranges":["<0.7.1"],"fixed":["0.7.1"]}]},{"id":"GO-2026-4672","url":"https://osv.dev/vulnerability/GO-2026-4672","summary":"Quill has DoS via unbounded read of HTTP response body during notarization in github.com/anchore/quill","modified":"2026-03-23T04:52:52.822493Z","packages":[{"ecosystem":"Go","name":"github.com/anchore/quill","purl":"pkg:golang/github.com/anchore/quill","ranges":["<0.7.1"],"fixed":["0.7.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}