CVE-2026-72714: Incomplete Cleanup in rocq-prover rocq
Description
Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps its own copy which is left disabled. The two views then disagree: Test Universe Checking reports the check as enabled while the kernel continues to accept universe-inconsistent terms. With the constraint between two universes no longer enforced, Hurkens' paradox applies and yields a proof of False, from which any proposition follows. The proof uses no axioms, plugins or unsafe features once the module has closed, and Print Assumptions reports it as closed under the global context, so neither the assumption audit nor the flag query reflects the actual kernel state. No fix is available.
CVSS v4.0
Score 6.8medium
Affected software
rocq-prover
rocq
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because rocq-prover does not restore the universe graph's copy of the universe checking flag when a module that locally disables the check ends. The local unset of universe checking is expected to be temporary, but the universe graph retains the disabled state, causing a mismatch between the test universe checking (which reports enabled) and the kernel (which accepts inconsistent terms). This allows the constraint between universes to be bypassed, enabling Hurkens' paradox to produce a proof of False without relying on axioms, plugins, or unsafe features after module closure. The kernel state is not reflected in assumption audits or flag queries, making detection difficult.
Potential Impact
An attacker can exploit this vulnerability to derive a proof of False, effectively allowing the proof of any proposition. This undermines the soundness of the rocq-prover system, potentially invalidating all proofs and compromising the integrity of the system's logical framework. The vulnerability does not require elevated privileges or unsafe features and can be triggered by closing a module that disables universe checking locally.
Mitigation Recommendations
No fix or patch is currently available for this vulnerability. Users should be aware of the risk and avoid relying on modules that locally disable universe checking until an official remediation is provided. Monitor vendor advisories for updates on patch availability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T13:02:52.001Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8ca814acd9273b49150592
Added to database: 08/24/2026, 20:22:44 UTC
Last enriched: 09/25/2026, 02:39:16 UTC
Last updated: 10/08/2026, 18:48:48 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.