https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 17:37:08 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-72705 <p>The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint&#39;s own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function to a plain definition is rejected because the checker unfolds the definition and observes the call, but passing it to a fixpoint is accepted because higher-order recursive calls through fixpoint arguments are not tracked. This admits a type that is definitionally equal to its own negation, so self-application produces False in purely definitional code, without tactics, axioms, plugins or unsafe flags, and Print Assumptions reports the result as closed under the global context. Fixed in Rocq 9.2.0.</p> <p>The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint&#39;s own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function to a plain definition is rejected because the checker unfolds the definition and observes the call, but passing it to a fixpoint is accepted because higher-order recursive calls through fixpoint arguments are not tracked. This admits a type that is definitionally equal to its own negation, so self-application produces False in purely definitional code, without tactics, axioms, plugins or unsafe flags, and Print Assumptions reports the result as closed under the global context. Fixed in Rocq 9.2.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-72705 https://db.gcve.eu/vuln/gcve-1988-2026-0445 <p><strong>Affected:</strong> rocq-prover rocq</p> <p>1. Summary ========== A soundness bug in the Rocq (formerly Coq) kernel&#39;s guard checker allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1 — without axioms, tactics, plugins, or unsafe flags. Print Assumptions reports the proof as closed under the global context. The guard checker does not track recursive calls made through a fixpoint&#39;s own arguments. A fixpoint can pass itself to another fixpoint, which can apply it to a value that is not a structural subterm. Passing the function to a plain definition is correctly rejected, but passing it to a fixpoint is accepted. This admits a type that is definitionally equal to its own negation, and self-application yields False in purely definitional code. 2. Context ========== Rocq (formerly Coq) is the reference implementation of the Calculus of Inductive Constructions and one of the most widely deployed proof assistants. Its kernel is the trusted core that checks every proof before acceptance. A soundness bug in the guard checker — the component that enforces termination of recursive definitions — undermines the guarantees of any system built on Rocq-checked proofs. Formally verified systems certified under Common Criteria (ISO 15408) or DO-178C (airborne software) derive their assurance from the correctness of the proof checker. A kernel-level bypass invalidates that assurance chain. This bug was discovered by Claude Opus 4.6 (Anthropic) during a fuzzing campaign. 3. Impact =======…</p> <p><strong>Affected:</strong> rocq-prover rocq</p> <p>1. Summary ========== A soundness bug in the Rocq (formerly Coq) kernel&#39;s guard checker allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1 — without axioms, tactics, plugins, or unsafe flags. Print Assumptions reports the proof as closed under the global context. The guard checker does not track recursive calls made through a fixpoint&#39;s own arguments. A fixpoint can pass itself to another fixpoint, which can apply it to a value that is not a structural subterm. Passing the function to a plain definition is correctly rejected, but passing it to a fixpoint is accepted. This admits a type that is definitionally equal to its own negation, and self-application yields False in purely definitional code. 2. Context ========== Rocq (formerly Coq) is the reference implementation of the Calculus of Inductive Constructions and one of the most widely deployed proof assistants. Its kernel is the trusted core that checks every proof before acceptance. A soundness bug in the guard checker — the component that enforces termination of recursive definitions — undermines the guarantees of any system built on Rocq-checked proofs. Formally verified systems certified under Common Criteria (ISO 15408) or DO-178C (airborne software) derive their assurance from the correctness of the proof checker. A kernel-level bypass invalidates that assurance chain. This bug was discovered by Claude Opus 4.6 (Anthropic) during a fuzzing campaign. 3. Impact =======…</p> https://db.gcve.eu/vuln/gcve-1988-2026-0445 https://db.gcve.eu/vuln/ghsa-f4rc-7978-q94g <p>The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint&#39;s own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function to a plain definition is rejected because the checker unfolds the definition and observes the call, but passing it to a fixpoint is accepted because higher-order recursive calls through fixpoint arguments are not tracked. This admits a type that is definitionally equal to its own negation, so self-application produces False in purely definitional code, without tactics, axioms, plugins or unsafe flags, and Print Assumptions reports the result as closed under the global context. Fixed in Rocq 9.2.0.</p> <p>The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint&#39;s own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function to a plain definition is rejected because the checker unfolds the definition and observes the call, but passing it to a fixpoint is accepted because higher-order recursive calls through fixpoint arguments are not tracked. This admits a type that is definitionally equal to its own negation, so self-application produces False in purely definitional code, without tactics, axioms, plugins or unsafe flags, and Print Assumptions reports the result as closed under the global context. Fixed in Rocq 9.2.0.</p> https://db.gcve.eu/vuln/ghsa-f4rc-7978-q94g