As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-72705: Rocq guard checker accepts fixpoint passed as higher-order argument (0 = 1 demonstrated)
CVE-2026-72705 is a soundness vulnerability in the Rocq kernel's guard checker that allows construction of a proof of any false proposition, including 0 = 1, without axioms or unsafe flags. The bug arises because the guard checker fails to track recursive calls made through a fixpoint's own arguments, permitting a fixpoint to pass itself recursively. This breaks the logical consistency of proofs verified by the system.
Why it matters: Developers and researchers using Rocq for formal verification must immediately audit proofs created with affected versions, as the soundness guarantee is broken and any proof may be invalid.
- Source published
- First seen by Cybersecurity Tracker