{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/formal-verification/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocq:prover:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72705"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rocq Prover"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","formal-verification","rocq"],"_cs_type":"advisory","_cs_vendors":["Rocq"],"content_html":"\u003cp\u003eThe Rocq (formerly Coq) kernel contains a soundness vulnerability in its guard checker, identified as CVE-2026-72705. The flaw occurs because the guard checker fails to correctly track recursive calls made through a fixpoint's own arguments. This allows for the construction of proofs that appear valid but conclude false propositions, such as 0 = 1, without the use of axioms, tactics, plugins, or unsafe flags. The system reports these malformed proofs as closed under the global context.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability compromises the integrity of formally verified proofs generated by the Rocq Prover. If an attacker produces a false proof in a system relying on Rocq for verification, the security or logic properties guaranteed by that proof are invalidated.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all projects or systems utilizing the Rocq Prover to generate formal proofs.\u003c/li\u003e\n\u003cli\u003eMonitor official Rocq development channels for the release of a patched version.\u003c/li\u003e\n\u003cli\u003eReview critical proofs that were generated using affected versions of the Rocq kernel to verify they do not rely on the identified guard checker flaw.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T04:24:18Z","date_published":"2026-10-26T04:24:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-vulnerability/","summary":"A logic flaw in the Rocq kernel guard checker permits the construction of false proofs by failing to track recursive calls in fixpoints, undermining the integrity of formal verification.","title":"Rocq Prover: Soundness vulnerability in guard checker (CVE-2026-72705)","url":"https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-vulnerability/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:leanprover:lean:4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72844"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Lean 4"],"_cs_severities":["high"],"_cs_tags":["vulnerability","formal-verification","logic-soundness"],"_cs_type":"advisory","_cs_vendors":["Lean"],"content_html":"\u003cp\u003eA soundness vulnerability in the Lean 4 kernel (CVE-2026-72844) enables the construction of checked proofs of 'False' (e.g., 0 = 1). The flaw stems from two primary issues: the kernel fails to verify that the structure named in a projection expression matches the type of the value being projected, and the \u003ccode\u003eenvironment::add_inductive\u003c/code\u003e function in \u003ccode\u003esrc/kernel/inductive.cpp\u003c/code\u003e fails to perform necessary type-checking for nested definitions. This compromise undermines the foundational logical guarantees of the theorem prover. No further update has been provided regarding fixed versions or mitigation timelines beyond the initial disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows for the creation of arbitrary proofs of logically false propositions within the Lean 4 environment. It does not require the use of explicit axioms, the \u003ccode\u003esorry\u003c/code\u003e keyword, \u003ccode\u003eunsafeCast\u003c/code\u003e operations, or the modification of \u003ccode\u003e.olean\u003c/code\u003e files, allowing the exploit to bypass standard verification checks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory environments utilizing Lean 4 for formal verification or critical logical proofs.\u003c/li\u003e\n\u003cli\u003eMonitor the official Lean 4 repository and the \u003ccode\u003eoss-security\u003c/code\u003e mailing list for the release of security patches or official mitigation guidance.\u003c/li\u003e\n\u003cli\u003eReview critical proof developments that depend on the integrity of the Lean 4 kernel; consider re-verifying proofs using patched versions once updates are available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T02:22:56Z","date_published":"2026-10-26T02:22:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lean4-soundness/","summary":"A soundness vulnerability in the Lean 4 kernel allows the construction of false mathematical proofs due to improper validation of structure projections and insufficient type-checking in the inductive definition process.","title":"Lean 4: Kernel soundness vulnerability via nested inductive projections (CVE-2026-72844)","url":"https://feed.craftedsignal.io/briefs/2026-10-lean4-soundness/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocq_project:rocq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72714"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rocq"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rocq","formal-verification"],"_cs_type":"advisory","_cs_vendors":["Rocq Project"],"content_html":"\u003cp\u003eA soundness flaw in the Rocq kernel, identified as CVE-2026-72714, allows the construction of proofs of False without the use of axioms, plugins, or unsafe flags. The issue arises from a desynchronization in the module system, where the environment fails to correctly restore the \u0026quot;Universe Checking\u0026quot; flag state after closing a module that had disabled this check locally. Consequently, Print Assumptions incorrectly reports the resulting proofs as closed under the global context. This vulnerability undermines the logical consistency of formal proofs within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows users to generate cryptographically or logically invalid proofs that the system accepts as valid, including the derivation of 0 = 1. This could be exploited to bypass security or verification properties in formal proofs relying on Rocq.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all projects using the Rocq kernel that rely on formal proof verification for security-critical properties.\u003c/li\u003e\n\u003cli\u003eAudit existing proof scripts for the use of \u0026quot;Local Unset Universe Checking\u0026quot; commands.\u003c/li\u003e\n\u003cli\u003eReview documentation from the Rocq Project for patch availability or guidance on disabling module-local universe checking until a fix is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T02:22:26Z","date_published":"2026-10-26T02:22:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rocq-soundness-vulnerability/","summary":"A logic soundness vulnerability in the Rocq kernel allows for the construction of invalid proofs due to improper state management of the universe checking flag after closing a module.","title":"Rocq: Soundness vulnerability in module system (CVE-2026-72714)","url":"https://feed.craftedsignal.io/briefs/2026-10-rocq-soundness-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Formal-Verification","version":"https://jsonfeed.org/version/1.1"}