{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rocq-project/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocq_project:rocq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72714"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rocq"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rocq","formal-verification"],"_cs_type":"advisory","_cs_vendors":["Rocq Project"],"content_html":"\u003cp\u003eA soundness flaw in the Rocq kernel, identified as CVE-2026-72714, allows the construction of proofs of False without the use of axioms, plugins, or unsafe flags. The issue arises from a desynchronization in the module system, where the environment fails to correctly restore the \u0026quot;Universe Checking\u0026quot; flag state after closing a module that had disabled this check locally. Consequently, Print Assumptions incorrectly reports the resulting proofs as closed under the global context. This vulnerability undermines the logical consistency of formal proofs within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows users to generate cryptographically or logically invalid proofs that the system accepts as valid, including the derivation of 0 = 1. This could be exploited to bypass security or verification properties in formal proofs relying on Rocq.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all projects using the Rocq kernel that rely on formal proof verification for security-critical properties.\u003c/li\u003e\n\u003cli\u003eAudit existing proof scripts for the use of \u0026quot;Local Unset Universe Checking\u0026quot; commands.\u003c/li\u003e\n\u003cli\u003eReview documentation from the Rocq Project for patch availability or guidance on disabling module-local universe checking until a fix is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T02:22:26Z","date_published":"2026-10-26T02:22:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rocq-soundness-vulnerability/","summary":"A logic soundness vulnerability in the Rocq kernel allows for the construction of invalid proofs due to improper state management of the universe checking flag after closing a module.","title":"Rocq: Soundness vulnerability in module system (CVE-2026-72714)","url":"https://feed.craftedsignal.io/briefs/2026-10-rocq-soundness-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Rocq Project","version":"https://jsonfeed.org/version/1.1"}