CVE-2026-31960

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31960", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.482Z", "datePublished": "2026-03-11T19:31:34.867Z", "dateUpdated": "2026-03-12T19:58:33.103Z"}, "containers": {"cna": {"title": "DoS in Quill via unbounded read of HTTP response body during notarization", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g"}], "affected": [{"vendor": "anchore", "product": "quill", "versions": [{"version": "< 0.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:31:34.867Z"}, "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1."}], "source": {"advisory": "GHSA-g32c-4pvp-769g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T19:58:23.280187Z", "id": "CVE-2026-31960", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:58:33.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31960", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T19:58:23.280187Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:58:30.269Z"}}], "cna": {"title": "DoS in Quill via unbounded read of HTTP response body during notarization", "source": {"advisory": "GHSA-g32c-4pvp-769g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "anchore", "product": "quill", "versions": [{"status": "affected", "version": "< 0.7.1"}]}], "references": [{"url": "https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g", "name": "https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:31:34.867Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31960", "state": "PUBLISHED", "dateUpdated": "2026-03-12T19:58:33.103Z", "dateReserved": "2026-03-10T15:40:10.482Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T19:31:34.867Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "quill", "vendor": "anchore", "versions": [{"status": "affected", "version": "< 0.7.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anchore:quill:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1E31EEF-FC47-43F9-8797-60E94FB1C0E5", "versionEndExcluding": "0.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1."}, {"lang": "es", "value": "Quill proporciona firma binaria de mac simple y notarizaci\u00f3n desde cualquier plataforma. Quill antes de la versi\u00f3n v0.7.1 tiene lecturas ilimitadas de cuerpos de respuesta HTTP durante el proceso de notarizaci\u00f3n de Apple. La explotaci\u00f3n requiere la capacidad de modificar respuestas de API del servicio de notarizaci\u00f3n de Apple, lo cual no es posible bajo condiciones de red est\u00e1ndar debido a HTTPS con validaci\u00f3n adecuada de certificados TLS; sin embargo, entornos con proxies de intercepci\u00f3n TLS (comunes en redes corporativas), autoridades de certificaci\u00f3n comprometidas, u otras violaciones de l\u00edmites de confianza est\u00e1n en riesgo. Al procesar respuestas HTTP durante la notarizaci\u00f3n, Quill lee el cuerpo completo de la respuesta en la memoria sin ning\u00fan l\u00edmite de tama\u00f1o. Un atacante que puede controlar o modificar el contenido de la respuesta puede devolver una carga \u00fatil arbitrariamente grande, haciendo que el cliente de Quill se quede sin memoria y falle. El impacto se limita a la disponibilidad; no hay efecto en la confidencialidad o integridad. Tanto la CLI de Quill como la biblioteca se ven afectadas cuando se utilizan para realizar operaciones de notarizaci\u00f3n. Esta vulnerabilidad se corrige en 0.7.1."}], "id": "CVE-2026-31960", "lastModified": "2026-06-17T10:34:50.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31960", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T19:58:23.280187Z", "version": "2.0.3"}}]}, "published": "2026-03-11T20:16:16.940", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.7.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "quill", "source": "cna", "vendor": "anchore"}, "product": "quill", "vendor": "anchore"}], "analysis": {"en": {"generated_at": "2026-03-17T17:08:35.072991+00:00", "value": {"mitigation_remediation": ["Apply the latest Quill release (0.7.1 or newer) to eliminate the unbounded memory read.", "Verify that the network path to Apple\u2019s notarization service does not include TLS\u2011intercepting proxies or tampered certificate authorities.", "If upgrading immediately is not possible, restrict notarization traffic to trusted, non\u2011intercepted network segments."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service \u2013 Availability loss due to unbounded memory consumption during notarization"}, "threat_synthesis": {"affected_systems": "All releases of Anchore Quill (both CLI and underlying library) prior to version\u202f0.7.1 are affected when performing notarization operations. The issue was fixed in 0.7.1 and later.", "description_and_impact": "Quill performs an unbounded read of HTTP response bodies during Apple notarization, buffering the entire response into memory without imposing a size limit. If an attacker can alter the response payload, they can cause the client to consume excessive memory and crash, leading to a denial of service. This weakness is identified as CWE\u2011770; it does not affect confidentiality or integrity.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity denial\u2011of\u2011service flaw, while the EPSS score of less than 1\u202f% suggests a low likelihood of exploitation in the near term. The advisory states that exploitation requires the ability to modify Apple\u2019s notarization service responses, which is normally prevented by HTTPS with proper TLS certificate validation. However, environments that use TLS\u2011intercepting proxies, have compromised certificate authorities, or otherwise violate the trust boundary are at risk. The likely attack vector is therefore inferred to involve TLS interception or CA compromise. Because the exploit depends on such uncommon conditions, the overall risk is moderate and largely contingent on the presence of these network vulnerabilities."}}}}, "created": "2026-03-12T09:56:41.208090+00:00", "updated": "2026-03-20T15:29:15.508643+00:00", "vendors": ["anchore", "anchore$PRODUCT$quill"]}