CVE-2026-44368 PyQuorum: Timing side‑channel in mul_mod
An attacker can recover secret shares via timing side-channel attacks in the mul_mod function, leading to secret reconstruction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44368?
CVE-2026-44368 is a medium-severity vulnerability in svvqt pyquorum, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.
Weakness: CWE-208
Which versions are affected by CVE-2026-44368?
3 open source packages ship an affected version, including pyquorum.
| Package | Affected | Fixed in |
|---|---|---|
pyquorum PyPI | All versions | 0.2.1 |
pyquorum PyPI | All versions | 0.2.1 |
pyquorum PyPI | All versions | 0.2.1 |
How do I fix CVE-2026-44368?
Upgrade pyquorum to 0.2.1 or later.
Is CVE-2026-44368 being exploited?
There is no known exploitation of CVE-2026-44368 in the wild and no public exploit code.
Sources
Also known as GHSA-7r92-3jgr-r65q, PYSEC-2026-3028.