—
GO-2026-4675
Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing in github.com/anchore/quill
Quick fix
GO-2026-4675 — github.com/anchore/quill: upgrade to the fixed version with the command below.
go get github.com/anchore/quill@v0.7.1Details
Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing in github.com/anchore/quill
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-31961[ADVISORY]
- https://github.com/anchore/quill/commit/80cf3fe082678af0ec4f9f8dd93f39189d2dc1fe[FIX]
- https://developer.apple.com/documentation/technotes/tn3126-inside-code-signing-hashes[WEB]
- https://github.com/anchore/quill/releases/tag/v0.7.1[WEB]