As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day
A soundness vulnerability in the Rocq kernel's guard checker permits construction of a checked proof of False by failing to revalidate the recursive tree after a transport operation modifies an inductive type parameter. An attacker can craft a fixpoint that rewrites a recursive argument along a type equality, bypassing the checker's validation and enabling proofs of any proposition, including 0 = 1.
Why it matters: Developers and researchers relying on Rocq for formal verification must treat proofs generated in affected versions as unreliable, as the soundness guarantee is broken and any theorem could be false; immediate patching is critical for projects depending on proof correctness.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated), 0-day
A soundness vulnerability in the Rocq kernel's guard checker permits construction of a checked proof of False by failing to revalidate the recursive tree after a transport operation modifies an inductive type parameter. An attacker can craft a fixpoint that rewrites a recursive argument along a type equality, bypassing the checker's validation and enabling proofs of any proposition, including 0 = 1.
Why it matters: Developers and researchers relying on Rocq for formal verification must treat proofs generated in affected versions as unreliable, as the soundness guarantee is broken and any theorem could be false; immediate patching is critical for projects depending on proof correctness.
- Source published
- First seen by Cybersecurity Tracker