pyquorum CVE-2026-44368

Upgrade pyquorum to version 0.2.1 or later using pip install --upgrade pyquorum; this is the vendor-confirmed fix as documented in GHSA-7r92-3jgr-r65q and released at https://github.com/svvqt/pyquorum/releases/tag/v0.2.1. The patch replaces the variable-time mul_mod with a constant-time Mersenne reduction implementation that eliminates data-dependent branching. If an immediate upgrade is not feasible, the primary compensating control is to avoid exposing shamir_split or shamir_combine operations over any network interface where an adversary can obtain precise timing measurements; isolating these calls to local, non-networked contexts removes the remote timing oracle entirely. Introducing artificial uniform latency padding around secret-sharing endpoints can degrade the timing signal but does not eliminate the root cause, adds latency overhead, and is easily bypassed with additional query volume. Aggressive rate-limiting on secret-sharing API endpoints (e.g., token bucket limiting to a few requests per second per client) reduces the attacker's ability to gather the thousands of samples required for statistical recovery but again is not a substitute for patching. Monitoring for abnormally high query rates to secret-sharing endpoints can serve as a detection signal.