Memory Management Flaw in Quill Notarization Process by Anchore

CVE-2026-31960

What is CVE-2026-31960?

Quill, a tool for macOS binary signing and notarization, experiences a vulnerability that allows unbounded reads of HTTP response bodies during the notarization process. This flaw manifests in versions before v0.7.1, where Quill does not impose limits on the size of the HTTP responses it processes. Although standard network configurations with HTTPS and valid TLS certificates offer protection, environments with TLS-intercepting proxies or compromised certificate authorities can be exploited. If an attacker is able to control the API responses from Apple's notarization service, they can manipulate the response to include excessively large payloads, potentially exhausting the memory of the Quill client and causing it to crash. This impacts the availability of the service but does not compromise data confidentiality or integrity.

References