{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rocq/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocq:prover:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72705"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rocq Prover"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","formal-verification","rocq"],"_cs_type":"advisory","_cs_vendors":["Rocq"],"content_html":"\u003cp\u003eThe Rocq (formerly Coq) kernel contains a soundness vulnerability in its guard checker, identified as CVE-2026-72705. The flaw occurs because the guard checker fails to correctly track recursive calls made through a fixpoint's own arguments. This allows for the construction of proofs that appear valid but conclude false propositions, such as 0 = 1, without the use of axioms, tactics, plugins, or unsafe flags. The system reports these malformed proofs as closed under the global context.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability compromises the integrity of formally verified proofs generated by the Rocq Prover. If an attacker produces a false proof in a system relying on Rocq for verification, the security or logic properties guaranteed by that proof are invalidated.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all projects or systems utilizing the Rocq Prover to generate formal proofs.\u003c/li\u003e\n\u003cli\u003eMonitor official Rocq development channels for the release of a patched version.\u003c/li\u003e\n\u003cli\u003eReview critical proofs that were generated using affected versions of the Rocq kernel to verify they do not rely on the identified guard checker flaw.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T04:24:18Z","date_published":"2026-10-26T04:24:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-vulnerability/","summary":"A logic flaw in the Rocq kernel guard checker permits the construction of false proofs by failing to track recursive calls in fixpoints, undermining the integrity of formal verification.","title":"Rocq Prover: Soundness vulnerability in guard checker (CVE-2026-72705)","url":"https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-vulnerability/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocq:kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72704"},{"cvss":6.3,"id":"CVE-2026-72703"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rocq kernel"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Rocq"],"content_html":"\u003cp\u003eA soundness flaw in the Rocq (formerly Coq) kernel guard checker allows the construction of a checked proof of False. The issue occurs because the guard checker fails to re-examine the recursive tree for an inductive type parameter after a transport (rewrite) operation modifies that parameter. By applying a rewrite along a type equality to a recursive argument, an attacker can bypass the termination checker, enabling the derivation of arbitrary propositions, including 0 = 1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability invalidates the logical consistency of proofs generated by the Rocq kernel. This allows users to construct proofs that are technically accepted by the kernel but mathematically unsound, which may impact the verification integrity of software, compilers, or cryptographic primitives relying on the Rocq proof assistant.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory environments utilizing the Rocq (formerly Coq) proof assistant to verify mathematical proofs or extract verified code.\u003c/li\u003e\n\u003cli\u003eMonitor official Rocq development channels for patch releases addressing this guard checker deficiency.\u003c/li\u003e\n\u003cli\u003eReview critical proofs generated or re-checked by the affected version to ensure they do not rely on rewritten recursive arguments that might have bypassed guard checking.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T02:22:45Z","date_published":"2026-10-26T02:22:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-cve/","summary":"A soundness vulnerability in the Rocq kernel guard checker fails to revalidate recursive tree parameters after a transport rewrite, allowing the derivation of arbitrary mathematical proofs.","title":"Rocq: Soundness vulnerability in guard checker (CVE-2026-72704)","url":"https://feed.craftedsignal.io/briefs/2026-10-rocq-guard-checker-cve/"}],"language":"en","title":"CraftedSignal Threat Feed - Rocq","version":"https://jsonfeed.org/version/1.1"}