5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31960

CVE-2026-31960: DoS in Quill via unbounded read of HTTP response body during notarization

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31960

CVE-2026-31960:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/anchore/quill	go	< 0.7.1	0.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service caused by unbounded reads of data, primarily from HTTP responses. The core of the vulnerability was in the notary.APIClient.handleResponse function, which used io.ReadAll on the response body without any size limit. This was directly exploitable through the notary.APIClient.submissionLogs function, which is used to fetch Apple notarization logs. An attacker, able to control the HTTP response in a man-in-the-middle scenario, could provide a massive response body, causing the Quill client to exhaust its memory and crash.

The patch introduces a new utility function, utils.ReadAllLimited, which wraps io.LimitReader to enforce a maximum size on data read from any io.Reader. This new function was then used to replace all instances of io.ReadAll that operated on untrusted input streams. The fix was applied not only to the primary vulnerable function handleResponse but also to other parts of the codebase that performed similar unbounded reads, such as load.BytesFromFileOrEnv (reading files) and an internal download function for fetching certificates. The identified functions would appear in a runtime profile when the notarization process is triggered, with submissionLogs and handleResponse being the key indicators of the vulnerable code path being executed.

Vulnerable functions

notary.APIClient.handleResponse

quill/notary/api_client.go

This function was responsible for reading the body of HTTP responses. In the vulnerable version, it used `io.ReadAll` without any size constraints, allowing an attacker to send an arbitrarily large response body, leading to excessive memory consumption and a denial of service.

notary.APIClient.submissionLogs

quill/notary/api_client.go

This function fetches notarization logs during the Apple notarization process. It used the vulnerable `handleResponse` function to process the log content retrieved from a URL. As this URL could point to a very large file controlled by an attacker (in a compromised environment), this function served as a primary entry point for the denial-of-service vulnerability.

load.BytesFromFileOrEnv

quill/pki/load/bytes.go

This function reads file contents into memory. Although the primary vulnerability description focuses on HTTP responses, the same patch also fixed an unbounded read from the local filesystem in this function. It was vulnerable to a denial of service if a malicious or unexpectedly large PKI file was processed.

main.download

quill/pki/apple/internal/generate/main.go

This function, part of an internal tool to generate certificate code, downloaded files from the network using an unbounded `io.ReadAll`. While not part of the main runtime library, it represented a similar vulnerability pattern fixed by the same patch, where a large HTTP response could cause the tool to crash.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.