Rocq Prover - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rocq-prover/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 04:24:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRocq Prover: Soundness vulnerability in guard checker (CVE-2026-72705)https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-vulnerability/Mon, 26 Oct 2026 04:24:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-vulnerability/A logic flaw in the Rocq kernel guard checker permits the construction of false proofs by failing to track recursive calls in fixpoints, undermining the integrity of formal verification.The Rocq (formerly Coq) kernel contains a soundness vulnerability in its guard checker, identified as CVE-2026-72705. The flaw occurs because the guard checker fails to correctly track recursive calls made through a fixpoint's own arguments. This allows for the construction of proofs that appear valid but conclude false propositions, such as 0 = 1, without the use of axioms, tactics, plugins, or unsafe flags. The system reports these malformed proofs as closed under the global context.

Impact

The vulnerability compromises the integrity of formally verified proofs generated by the Rocq Prover. If an attacker produces a false proof in a system relying on Rocq for verification, the security or logic properties guaranteed by that proof are invalidated.

Recommendation

  • Identify all projects or systems utilizing the Rocq Prover to generate formal proofs.
  • Monitor official Rocq development channels for the release of a patched version.
  • Review critical proofs that were generated using affected versions of the Rocq kernel to verify they do not rely on the identified guard checker flaw.
]]>mediumadvisoryvulnerabilityformal-verificationrocq