CVE-2026-44368— PyQuorum: Timing side‑channel in mul_mod
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44368
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PyQuorum: Timing side‑channel in mul_mod
Source: NVD (National Vulnerability Database)
Vulnerability Description
PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过时间差异性导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
PyQuorum 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PyQuorum是svvqt个人开发者的一个密钥管理与秘密共享的加密库。 PyQuorum 0.2.1之前版本存在安全漏洞，该漏洞源于mul_mod函数通过二进制展开循环实现乘法，其执行时间取决于第二个操作数的汉明重量，攻击者可通过测量秘密共享操作的时间逐步恢复共享值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44368
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44368
请登录查看更多情报信息。
- https://github.com/svvqt/pyquorum/security/advisories/GHSA-7r92-3jgr-r65qx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-44368
IV. Related Vulnerabilities
Same weakness: CWE-208
- CVE-2026-42602
azureauthextension Authenticate method does not validate bea - CVE-2026-43514
Apache Tomcat: AJP secret compared in non-constant time - CVE-2026-41588
RELATE: Timing Attack Vulnerability in course/auth.py — chec - CVE-2026-41161
Username Enumeration via Timing Attack - CVE-2026-33006
Apache HTTP Server: mod_auth_digest timing attack
V. Comments for CVE-2026-44368
No comments yet