Quick answers
- Is CVE-2026-31961 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-31961 being exploited in the wild.
- How severe is CVE-2026-31961?
- Medium severity, with a CVSS score of 5.5, published 11 March 2026.
- Which products and versions are affected?
- github.com/anchore/quill (Go) < 0.7.1, SEMVER:introduced=0,fixed=0.7.1.
- Is there a fix for CVE-2026-31961?
- Yes. github.com/anchore/quill (Go): upgrade to 0.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-31961 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-31961?
- Check whether you run github.com/anchore/quill (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- github.com/anchore/quill (Go): upgrade to 0.7.1 or later
go get github.com/anchore/quill@v0.7.1
Technical details
Quill before version 0.7.1 contains an unbounded memory allocation vulnerability (CWE-770) within its Mach-O binary parsing logic. The root cause is a failure to validate size and count fields—specifically DataSize, DataOffset, and Size from the LC_CODE_SIGNATURE load command, as well as Count and Length fields in SuperBlob and BlobIndex structures. An attacker can craft a small (~4KB) Mach-O binary with extremely large values in these fields. When processed by the Quill CLI or Go library, the application attempts to allocate excessive memory buffers, leading to memory exhaustion and a crash of the host process. The vulnerability is fixed in version 0.7.1.
Affected products
- anchore quill < 0.7.1
Identifiers
- CVE-2026-31961
- GHSA-xj69-m9qq-8m94
- GO-2026-4675
Timeline
- 2026-03-10: patched: Fixed in version 0.7.1
- 2026-03-11: advisory: GitHub Advisory published