Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-44368 EUVD-2026-30161GHSA-7r92-3jgr-r65qPYSEC-2026-3028

PyQuorum: Timing side‑channel in mul_mod

Published May 13, 2026 · Updated May 15, 2026 · Assigned by GitHub_M

Description

PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.

Affected products

VendorProductAffectedFixed
svvqt pyquorum < 0.2.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pyquorum < 0.2.1 0.2.1 GHSA-7r92-3jgr-r65q

References