CVE-2026-72705: Always-Incorrect Control Flow Implementation in rocq-prover rocq
Description
The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function to a plain definition is rejected because the checker unfolds the definition and observes the call, but passing it to a fixpoint is accepted because higher-order recursive calls through fixpoint arguments are not tracked. This admits a type that is definitionally equal to its own negation, so self-application produces False in purely definitional code, without tactics, axioms, plugins or unsafe flags, and Print Assumptions reports the result as closed under the global context. Fixed in Rocq 9.2.0.
CVSS v4.0
Score 6.8medium
Affected software
rocq-prover
rocq
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The guard checker in Rocq Prover fails to track recursive calls made through fixpoint arguments, allowing a fixpoint to pass itself as a higher-order argument to another fixpoint. This acceptance permits a type that is definitionally equal to its own negation, causing self-application to produce False purely through definitional code. This vulnerability does not rely on tactics, axioms, plugins, or unsafe flags and is considered closed under the global context. The flaw is resolved in Rocq 9.2.0.
Potential Impact
This vulnerability allows purely definitional code in Rocq Prover to produce a contradiction (False) by exploiting the incorrect control flow implementation in recursive fixpoints. This undermines the soundness guarantees of the system, potentially affecting proofs and formal verification relying on Rocq Prover. The CVSS 4.0 score of 6.8 indicates a medium severity impact with local attack vector, low complexity, no privileges required, but user interaction needed, and high impact on integrity.
Mitigation Recommendations
Upgrade to Rocq Prover version 9.2.0 or later, where this vulnerability is fixed. No other mitigation is necessary as the fix addresses the root cause in the guard checker.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T13:02:52.001Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8ca814acd9273b49150590
Added to database: 08/24/2026, 20:22:44 UTC
Last enriched: 09/25/2026, 02:39:03 UTC
Last updated: 10/06/2026, 18:48:24 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.