CVE-2026-72703: Always-Incorrect Control Flow Implementation in rocq-prover rocq
Description
The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. find_uniform_parameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes that every parameter is uniform. A parameter that grows through a cross-call from one body to another therefore keeps the subterm specification it inherited from the enclosing fixpoint, and a recursive call guarded by that specification is accepted although the argument is not structurally smaller. A non-terminating definition is admitted as structurally decreasing, which yields a term whose value equals its own successor and so a proof of False, from which any proposition follows. The proof requires no axioms, plugins or unsafe flags and Print Assumptions reports it as closed under the global context. Introduced in Coq 8.20 and fixed in Rocq 9.2.0.
CVSS v4.0
Score 6.8medium
Affected software
rocq-prover
rocq
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because the guard checker in Rocq Prover's kernel/inductive.ml inspects only self-recursive calls when determining uniform parameters in nested mutual fixpoints. If no body calls itself, the checker incorrectly concludes all parameters are uniform. This leads to acceptance of recursive calls that are not structurally smaller, permitting non-terminating definitions to be admitted as structurally decreasing. Consequently, a term can be constructed whose value equals its own successor, effectively proving False and allowing any proposition to be derived. This flaw requires no axioms, plugins, or unsafe flags and is closed under the global context. It was introduced in Coq 8.20 and fixed in Rocq 9.2.0.
Potential Impact
An attacker or user can exploit this vulnerability to construct proofs of False within the Rocq Prover environment, undermining the soundness of the proof system. This compromises the integrity of proofs generated, potentially allowing any proposition to be proven, which invalidates the trustworthiness of the system's outputs.
Mitigation Recommendations
This vulnerability is fixed in Rocq version 9.2.0. Users should upgrade to version 9.2.0 or later to remediate this issue. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T13:02:20.829Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8ca814acd9273b49150588
Added to database: 08/24/2026, 20:22:44 UTC
Last enriched: 09/25/2026, 02:38:55 UTC
Last updated: 10/08/2026, 06:48:19 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.