svvqt pyquorum up to 0.2.0 mul_mod timing discrepancy

Summaryinfo

A vulnerability was found in svvqt pyquorum up to 0.2.0. It has been rated as problematic. Affected by this issue is the function mul_mod. This manipulation causes timing discrepancy. This vulnerability is tracked as CVE-2026-44368. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in svvqt pyquorum up to 0.2.0. Affected by this vulnerability is the function mul_mod. The manipulation with an unknown input leads to a timing discrepancy vulnerability. The CWE definition for the vulnerability is CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality. The summary by CVE is:

PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-44368 since 05/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 0.2.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• svvqt

Name

• pyquorum

Version

• 0.1
• 0.2.0

Website

• Product: https://github.com/svvqt/pyquorum/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion