As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated) — 0-day
A soundness bug in the Rocq proof assistant kernel allows construction of a checked proof of False and other propositions without axioms or unsafe flags through universe checking state desynchronization when a module is closed. The module system fails to correctly restore the universe checking flag after a module that locally disabled the check is processed. This enables creation of proofs that appear closed under the global context while actually violating soundness.
Why it matters: Users of Rocq (formerly Coq) who rely on the proof assistant for verification should treat existing proofs as potentially unsound until fixes are applied; organizations using Rocq-verified systems should audit proofs created with affected versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated), 0-day
A soundness bug in the Rocq proof assistant kernel allows construction of a checked proof of False and other propositions without axioms or unsafe flags through universe checking state desynchronization when a module is closed. The module system fails to correctly restore the universe checking flag after a module that locally disabled the check is processed. This enables creation of proofs that appear closed under the global context while actually violating soundness.
Why it matters: Users of Rocq (formerly Coq) who rely on the proof assistant for verification should treat existing proofs as potentially unsound until fixes are applied; organizations using Rocq-verified systems should audit proofs created with affected versions.
- Source published
- First seen by Cybersecurity Tracker