PT-2026-38310 · Pypi · Pyquorum

CVE-2026-44368 · Published 2026-05-06 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions PyQuorum versions prior to 0.2.1

Description The mul mod() function implements multiplication using a binary expansion loop. The execution time of this process depends on the Hamming weight (the number of symbols that are different from zero) of the second operand, which serves as the exponent. An attacker capable of measuring the time taken for secret-sharing operations, such as through a remote service, could progressively recover share values and eventually reconstruct the secret.

Recommendations Update to version 0.2.1.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-44368

GHSA-7R92-3JGR-R65Q

PYSEC-2026-3028

Affected Products

Pyquorum

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44368.json · Exploit
• https://osv.dev/vulnerability/GHSA-7r92-3jgr-r65q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44368 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-3028 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44368 · Vendor Advisory
• https://github.com/svvqt/pyquorum/commit/1e9ac41dd3c305c13d7a6b7d227bf325be82d730 · Note
• https://github.com/svvqt/pyquorum/releases/tag/v0.2.1 · Note
• https://twitter.com/CVEnew/status/2054709224270402010 · Twitter Post
• https://github.com/svvqt/pyquorum/security/advisories/GHSA-7r92-3jgr-r65q · Note
• https://github.com/svvqt/pyquorum · Note
• https://t.me/CVEtracker/53702 · Telegram Post
• https://pypi.org/project/pyquorum · Note
• https://github.com/advisories/GHSA-7r92-3jgr-r65q · Note