---
id: CVE-2026-44368
aliases:
  - GHSA-7r92-3jgr-r65q
  - PYSEC-2026-3028
title: 'pyquorum: Timing side‑channel in mul_mod'
summary: 'pyquorum: Timing side‑channel in mul_mod'
severity: medium
vendor: pyquorum
product: pyquorum
ecosystem: pip
affected:
  - pyquorum < 0.2.1
patched:
  - pyquorum 0.2.1
published: '2026-05-06'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7r92-3jgr-r65q'
references:
  - url: 'https://github.com/svvqt/pyquorum/security/advisories/GHSA-7r92-3jgr-r65q'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44368'
  - url: >-
      https://github.com/svvqt/pyquorum/commit/1e9ac41dd3c305c13d7a6b7d227bf325be82d730
  - url: 'https://github.com/svvqt/pyquorum'
  - url: 'https://github.com/svvqt/pyquorum/releases/tag/v0.2.1'
tags:
  - osv
  - pip
epss: 0.00531
epssPercentile: 0.4249
ingestedAt: '2026-07-13T18:57:54.681Z'
---

## Overview

### Impact
The `mul_mod` function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction.

### Patches
https://github.com/svvqt/pyquorum/releases/tag/v0.2.1

## Affected packages

- `pyquorum < 0.2.1`

## Remediation

Upgrade to a patched release:

- `pyquorum 0.2.1`