CVE-2026-31960

CVE-2026-31960 affects Quill versions prior to v0.7.1, where it suffers from an unbounded read vulnerability during Apple notarization processes, allowing an attacker to cause an out-of-memory crash by sending an arbitrarily large HTTP response body. Exploitation requires an adjacent network attack vector (AV:A) with high complexity (AC:H), typically involving TLS-intercepting proxies or compromised certificate authorities, as standard HTTPS prevents this. The impact is limited to denial of service (availability) with no effect on confidentiality or integrity, resulting in a CVSS score of 5.3 (Medium). There is no evidence of active exploitation (KEV: No), nor are there public exploit modules available, and community discussion and media coverage are minimal.