GHSA-xj69-m9qq-8m94

Suggest an improvement
Source
https://github.com/advisories/GHSA-xj69-m9qq-8m94
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-xj69-m9qq-8m94/GHSA-xj69-m9qq-8m94.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xj69-m9qq-8m94
Aliases
Published
2026-03-11T00:38:00Z
Modified
2026-03-23T04:56:06Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing
Details

Impact

Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing.

When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files.

Patches

Fixed in Quill v0.7.1

Workarounds

None

Credit

Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability

Resources

Database specific 
{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-11T00:38:00Z",
    "nvd_published_at":  "2026-03-11T20:16:17Z",
    "severity":  "MODERATE"
}
References

Affected packages

Go / github.com/anchore/quill

Package

Name
github.com/anchore/quill
View open source insights on deps.dev
Purl
pkg:golang/github.com/anchore/quill

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-xj69-m9qq-8m94/GHSA-xj69-m9qq-8m94.json"