CVE-2026-31960 [Medium] | Denial of Service in Quill

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.01%	0.09%	+0.08%
2	2026-03-12	—	0.01%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.01%

0.09%

+0.08%

2026-03-12

—

0.01%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.3	3.1	MEDIUM	`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.3

3.1

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.6

3.6

[email protected]

Affected software / configurations for CVE-2026-31960

Vendor	Product	Version	Raw CPE
anchore	quill	< 0.7.1	cpe:2.3:a:anchore:quill::::::::

References for CVE-2026-31960

URL	Tags
https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g	Vendor Advisory

URL

CVE-2026-31960 | DoS in Quill via unbounded read of HTTP response body during notarization

Exploit prediction scoring system (EPSS) score for CVE-2026-31960

Common vulnerability scoring system (CVSS) metrics for CVE-2026-31960

Weakness enumeration for CVE-2026-31960

GitHub Security Advisory for CVE-2026-31960

Affected software / configurations for CVE-2026-31960

References for CVE-2026-31960