As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-72844: Lean 4 kernel soundness bug — forging proofs via nested inductive projections (0 = 1 demonstrated)
CVE-2026-72844 is a soundness bug in the Lean 4 kernel that allows construction of false proofs, such as proving 0 = 1, without axioms or unsafe operations. The vulnerability stems from the kernel's failure to verify that projection expressions match the type being projected, and from a lack of type-checking in the nested inductive handler.
Why it matters: Developers and researchers using Lean 4 for formal verification should treat proofs generated in affected versions as potentially unsound, and upgrade to a patched version to maintain the integrity of their proof systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-72844: Lean 4 kernel soundness bug: forging proofs via nested inductive projections (0 = 1 demonstrated)
CVE-2026-72844 is a soundness bug in the Lean 4 kernel that allows construction of false proofs, such as proving 0 = 1, without axioms or unsafe operations. The vulnerability stems from the kernel's failure to verify that projection expressions match the type being projected, and from a lack of type-checking in the nested inductive handler.
Why it matters: Developers and researchers using Lean 4 for formal verification should treat proofs generated in affected versions as potentially unsound, and upgrade to a patched version to maintain the integrity of their proof systems.
- Source published
- First seen by Cybersecurity Tracker