CVE-2026-44368

Description

PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.

PUBLISHED Reserved 2026-05-05 | Published 2026-05-13 | Updated 2026-05-15 | Assigner GitHub_M

Problem types

CWE-208: Observable Timing Discrepancy

Product status

References

github.com/...quorum/security/advisories/GHSA-7r92-3jgr-r65q

cve.org (CVE-2026-44368)

nvd.nist.gov (CVE-2026-44368)

Download JSON