{"id":"CVE-2026-44368","aliases":["GHSA-7r92-3jgr-r65q","PYSEC-2026-3028"],"title":"pyquorum: Timing side‑channel in mul_mod","summary":"pyquorum: Timing side‑channel in mul_mod","severity":"medium","vendor":"pyquorum","product":"pyquorum","ecosystem":"pip","affected":["pyquorum < 0.2.1"],"patched":["pyquorum 0.2.1"],"published":"2026-05-06","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7r92-3jgr-r65q","references":[{"url":"https://github.com/svvqt/pyquorum/security/advisories/GHSA-7r92-3jgr-r65q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44368"},{"url":"https://github.com/svvqt/pyquorum/commit/1e9ac41dd3c305c13d7a6b7d227bf325be82d730"},{"url":"https://github.com/svvqt/pyquorum"},{"url":"https://github.com/svvqt/pyquorum/releases/tag/v0.2.1"}],"tags":["osv","pip"],"epss":0.00314,"epssPercentile":0.24552,"ingestedAt":"2026-07-13T18:57:54.681Z","slug":"CVE-2026-44368","body":"## Overview\n\n### Impact\nThe `mul_mod` function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction.\n\n### Patches\nhttps://github.com/svvqt/pyquorum/releases/tag/v0.2.1\n\n## Affected packages\n\n- `pyquorum < 0.2.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pyquorum 0.2.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}