Detections
Analytics

SCA: security update for github.com/anchore/quill (GHSA-xj69-m9qq-8m94)

medium Tenable Self-Hosted Container Security Plugin ID 438669

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1
 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires
 that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as
 CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted
 for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the
 LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them
 to allocate memory buffers without validating that the values are reasonable or consistent with the actual
 file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the
 SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB)
 malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate
 excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host
 process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This
 vulnerability is fixed in 0.7.1. (CVE-2026-31961)

Solution

Update the github.com/anchore/quill library and its related packages to version 0.7.1 or later.

See Also

https://github.com/advisories/GHSA-xj69-m9qq-8m94

Plugin Details

Severity: Medium

ID: 438669

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 3/12/2026

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.49

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-31961

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/11/2026

Vulnerability Publication Date: 3/11/2026

Reference Information

CVE: CVE-2026-31961

cwe: CWE-770