CVE-2026-31960: 
NixOS vulnerability analysis and mitigation

CVE-2026-31960 is a Denial-of-Service vulnerability in Anchore Quill, a Go-based tool for macOS binary signing and notarization, caused by unbounded reads of HTTP response bodies during the Apple notarization process. It affects all versions of github.com/anchore/quill prior to v0.7.1. The vulnerability was published on March 10, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory). It was reported by opera-aklajn of Opera and patched by Anchore in the v0.7.1 release (Quill Release).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): when processing HTTP responses from Apple's notarization API, Quill called io.ReadAll() on the response body without imposing any size limit, allowing the entire response to be buffered into memory (Github Advisory). Exploitation requires an adjacent-network attacker capable of intercepting and modifying HTTPS responses — possible in environments with TLS-intercepting proxies, compromised certificate authorities, or other trust boundary violations common in corporate networks. The fix introduced a ReadAllLimited utility function enforcing a 5 MB cap for API JSON responses and a 50 MB cap for log file responses, replacing the unbounded io.ReadAll calls in quill/notary/api_client.go (Patch Commit). Both the Quill CLI and the Go library are affected when performing notarization operations.

The impact is limited exclusively to availability — there is no effect on confidentiality or integrity (Github Advisory). A successful attack causes the Quill process to exhaust available memory and crash, disrupting any CI/CD pipeline or build workflow that relies on Quill for macOS binary notarization. Because the vulnerability only affects the notarization client process itself, there is no risk of lateral movement, data exfiltration, or privilege escalation.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (4th percentile), indicating a very low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement to be in an adjacent network position and able to intercept or modify TLS-protected HTTPS traffic, significantly limiting the attacker pool to those with access to corporate TLS-intercepting proxies or compromised certificate authorities.

1. Identify target environment: Determine that the target organization uses Quill (versions < 0.7.1) in a CI/CD pipeline or build system for macOS binary notarization, and that the environment routes HTTPS traffic through a TLS-intercepting proxy or has a compromised CA.
2. Position for interception: Gain access to the TLS-intercepting proxy or compromise a trusted CA certificate to enable man-in-the-middle interception of HTTPS traffic between the Quill client and Apple's notarization API (api.notary.apple.com).
3. Intercept notarization API response: When Quill makes an HTTP GET or POST request to the Apple notarization API (e.g., submission status, submission logs), intercept the response at the proxy layer.
4. Inject oversized payload: Replace the legitimate API response body with an arbitrarily large payload (e.g., gigabytes of data) before forwarding it to the Quill client.
5. Trigger memory exhaustion: Quill's handleResponse function calls io.ReadAll() without a size limit, causing the process to allocate memory continuously until the system runs out of memory and the Quill process crashes, disrupting the notarization workflow (Github Advisory, Patch Commit).

• Process: Quill CLI or library process terminating unexpectedly with an out-of-memory (OOM) error during notarization operations.
• Logs: System OOM killer logs (e.g., Linux dmesg or /var/log/syslog) showing the Quill process killed due to memory exhaustion; application logs showing unexpected crashes during Apple notarization API calls.
• Network: Anomalously large HTTP response sizes observed in proxy logs for connections to Apple notarization API endpoints (api.notary.apple.com); unexpected TLS certificate chains or CA certificates not issued by Apple in traffic inspection logs.
• System: Sudden spike in memory consumption by the Quill process visible in system monitoring tools (e.g., top, htop, Prometheus metrics) immediately before a crash.

Upgrade Quill to version v0.7.1 or later, which enforces a 5 MB limit on API JSON responses and a 50 MB limit on log file responses using the new ReadAllLimited utility (Quill Release, Patch Commit). No official workarounds are available for unpatched versions (Github Advisory). As a defense-in-depth measure, organizations should audit TLS-intercepting proxy configurations to ensure they cannot be abused to inject malicious responses, and restrict notarization workflows to trusted network paths.

The vulnerability was credited to opera-aklajn of Opera, who responsibly disclosed it to Anchore (Github Advisory). Red Hat tracked the issue via Bugzilla (Bug 2446757) with medium severity, indicating awareness among enterprise Linux distributors that package or depend on Quill (Red Hat Bugzilla). No significant broader media coverage or notable public researcher commentary has been identified beyond the official advisory.