CVE-2026-31960: Anchore Quill denial of service via unbounded read in notarization

Executive brief

Quill, a tool used for signing and notarizing macOS applications, is vulnerable to a denial-of-service attack. An attacker who can intercept or manipulate network traffic between Quill and Apple's notarization services can send a massive data payload that causes the tool to crash. This could disrupt software release pipelines and automated build processes, though it does not risk the theft of sensitive data.

Technical details

Quill versions prior to v0.7.1 fail to impose a size limit when reading HTTP response bodies into memory during the Apple notarization process (CWE-770). An attacker capable of modifying API responses from Apple's notarization service—such as through a compromised certificate authority or a TLS-intercepting proxy—can deliver an arbitrarily large payload. This results in an out-of-memory (OOM) condition, causing the Quill CLI or library to crash. The vulnerability is primarily an availability risk and is mitigated by standard HTTPS/TLS validation unless the trust boundary is already compromised. The issue is fixed in version 0.7.1.

Affected products

• Anchore Quill < 0.7.1

Timeline

• 2026-03-10: patched: Fixed in version v0.7.1
• 2026-03-11: advisory

References

• https://api.github.com/users/opera-aklajn
• https://github.com/opera-aklajn
• https://api.github.com/users/opera-aklajn/gists%7B/gist_id%7D
• https://api.github.com/users/opera-aklajn/repos
• https://avatars.githubusercontent.com/u/225386233?v=4
• https://api.github.com/users/opera-aklajn/events%7B/privacy%7D