GCVE-1988-2026-0443

Vulnerability from gna-1988 – Published: 2026-11-02 07:29 – Updated: 2026-11-02 07:29
VLAI
Title
[Bugtraq] CVE-2026-72703: Rocq guard checker accepts non-terminating fixpoint via unchecked cross-calls (0 = 1 demonstrated)
Summary
1. Summary ========== A soundness bug in the Rocq (formerly Coq) kernel's guard checker allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1 — without axioms, tactics, plugins, or unsafe flags. Print Assumptions reports the proof as closed under the global context. The guard checker treats all parameters of a nested mutual fixpoint as uniform without examining cross-calls between the fixpoint's bodies. A parameter that grows through a cross-call retains an incorrect subterm specification, and a recursive call on a non-structurally-decreasing argument is accepted. This admits a non-terminating definition from which False follows. 2. Context ========== Rocq (formerly Coq) is the reference implementation of the Calculus of Inductive Constructions and one of the most widely deployed proof assistants. Its kernel is the trusted core that checks every proof before acceptance. A soundness bug in the guard checker — the component that enforces termination of recursive definitions — undermines the guarantees of any system built on Rocq-checked proofs. Formally verified systems certified under Common Criteria (ISO 15408) or DO-178C (airborne software) derive their assurance from the correctness of the proof checker. A kernel-level bypass invalidates that assurance chain. 3. Impact ========= - Formally verified compilers (CompCert) - Verified OS kernels (CertiKOS) - Separation logic frameworks (Iris) - Mathematical libraries (MathComp) - Proof-carrying code: a malicious .v file in a dependency could introduce unsound declarations - Verified smart contracts (ConCert) 4. Proof of Concept =================== A Docker-reproducible PoC is available: git clone https://github.com/endrazine/rocq-cve-poc-21682 cd rocq-cve-poc-21682 docker build -t rocq-cve-poc-21682 . docker run --rm rocq-cve-poc-21682 On a vulnerable version (Rocq 8.20 – <9.2.0), the output confirms the proof of 0 = 1 with no axioms. On a patched version (≥9.2.0), the guard checker rejects the fixpoint. 5. Root Cause ============= find_uniform_parameters in kernel/inductive.ml only inspects self-recursive calls within each body of a mutual fixpoint. When no body contains a self-recursive call (all calls are cross-calls), every parameter is marked as uniform. A parameter that varies across cross-calls retains an incorrect subterm specification, allowing the guard checker to accept a recursive call on a non-structurally- decreasing argument. CWE-670: Always-Incorrect Control Flow Implementation. 6. Scoring ========== CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N — 7.1 (High) CVSS 4.0: AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N — 6.8 (Medium) 7. CWE ====== CWE-670: Always-Incorrect Control Flow Implementation 8. CVE ====== CVE-2026-72703 (assigned by VulnCheck as CNA) 9. Affected Versions ==================== Rocq Prover 8.20 – <9.2.0 Fixed in: 9.2.0 10. Mitigation ============== - Upgrade to Rocq 9.2.0 or later. - Run coqchk on compiled .vo files as defense-in-depth. 11. References ============== Bug report:  https://github.com/rocq-prover/rocq/issues/21682 Fix:         https://github.com/rocq-prover/rocq/pull/21684 PoC:         https://github.com/endrazine/rocq-cve-poc-21682 VulnCheck: https://www.vulncheck.com/advisories/rocq-prover-before-guard-checker-accept... NVD:         https://nvd.nist.gov/vuln/detail/CVE-2026-72703 12. Timeline ============ 2025        Bug reported (rocq-prover/rocq#21682) 2025        Fix merged (PR #21684) in Rocq 9.2.0 2026-08-24  CVE-2026-72703 published by VulnCheck 2026-08-24  Docker-reproducible PoC published 13. Credit ========== Bug discovery:   Tristan Stérin, Claude Opus 4.6 (Anthropic) Kernel fix:      PR #21684 PoC packaging:   Jonathan Brossard (@endrazine) — MOABI / PSIRT.com
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
rocq-prover rocq Affected: unknown
guessed Create a notification for this product.
Credits
Jonathan Brossard
Relationships
analysis GCVE-1988-2026-0443 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rocq",
          "vendor": "rocq-prover",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonathan Brossard"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. Summary\n==========\nA soundness bug in the Rocq (formerly Coq) kernel\u0027s guard checker allows\nconstruction of a checked proof of False \u2014 and by extension, any\nproposition, including 0 = 1 \u2014 without axioms, tactics, plugins, or\nunsafe flags. Print Assumptions reports the proof as closed under the\nglobal context.\nThe guard checker treats all parameters of a nested mutual fixpoint as\nuniform without examining cross-calls between the fixpoint\u0027s bodies.\nA parameter that grows through a cross-call retains an incorrect subterm\nspecification, and a recursive call on a non-structurally-decreasing\nargument is accepted. This admits a non-terminating definition from\nwhich False follows.\n2. Context\n==========\nRocq (formerly Coq) is the reference implementation of the Calculus of\nInductive Constructions and one of the most widely deployed proof\nassistants. Its kernel is the trusted core that checks every proof\nbefore acceptance. A soundness bug in the guard checker \u2014 the component\nthat enforces termination of recursive definitions \u2014 undermines the\nguarantees of any system built on Rocq-checked proofs.\nFormally verified systems certified under Common Criteria (ISO 15408) or\nDO-178C (airborne software) derive their assurance from the correctness\nof the proof checker. A kernel-level bypass invalidates that assurance\nchain.\n3. Impact\n=========\n- Formally verified compilers (CompCert)\n- Verified OS kernels (CertiKOS)\n- Separation logic frameworks (Iris)\n- Mathematical libraries (MathComp)\n- Proof-carrying code: a malicious .v file in a dependency could\nintroduce unsound declarations\n- Verified smart contracts (ConCert)\n4. Proof of Concept\n===================\nA Docker-reproducible PoC is available:\ngit clone https://github.com/endrazine/rocq-cve-poc-21682\ncd rocq-cve-poc-21682\ndocker build -t rocq-cve-poc-21682 .\ndocker run --rm rocq-cve-poc-21682\nOn a vulnerable version (Rocq 8.20 \u2013 \u003c9.2.0), the output confirms the\nproof of 0 = 1 with no axioms. On a patched version (\u22659.2.0), the guard\nchecker rejects the fixpoint.\n5. Root Cause\n=============\nfind_uniform_parameters in kernel/inductive.ml only inspects\nself-recursive calls within each body of a mutual fixpoint. When no body\ncontains a self-recursive call (all calls are cross-calls), every\nparameter is marked as uniform. A parameter that varies across\ncross-calls retains an incorrect subterm specification, allowing the\nguard checker to accept a recursive call on a non-structurally-\ndecreasing argument.\nCWE-670: Always-Incorrect Control Flow Implementation.\n6. Scoring\n==========\nCVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N \u2014 7.1 (High)\nCVSS 4.0: AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N \u2014 6.8\n(Medium)\n7. CWE\n======\nCWE-670: Always-Incorrect Control Flow Implementation\n8. CVE\n======\nCVE-2026-72703 (assigned by VulnCheck as CNA)\n9. Affected Versions\n====================\nRocq Prover 8.20 \u2013 \u003c9.2.0\nFixed in: 9.2.0\n10. Mitigation\n==============\n- Upgrade to Rocq 9.2.0 or later.\n- Run coqchk on compiled .vo files as defense-in-depth.\n11. References\n==============\nBug report:\u00a0 https://github.com/rocq-prover/rocq/issues/21682\nFix:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0https://github.com/rocq-prover/rocq/pull/21684\nPoC:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0https://github.com/endrazine/rocq-cve-poc-21682\nVulnCheck:\nhttps://www.vulncheck.com/advisories/rocq-prover-before-guard-checker-accept...\nNVD:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0https://nvd.nist.gov/vuln/detail/CVE-2026-72703\n12. Timeline\n============\n2025\u00a0 \u00a0 \u00a0 \u00a0 Bug reported (rocq-prover/rocq#21682)\n2025\u00a0 \u00a0 \u00a0 \u00a0 Fix merged (PR #21684) in Rocq 9.2.0\n2026-08-24\u00a0 CVE-2026-72703 published by VulnCheck\n2026-08-24\u00a0 Docker-reproducible PoC published\n13. Credit\n==========\nBug discovery:\u00a0 \u00a0Tristan St\u00e9rin, Claude Opus 4.6 (Anthropic)\nKernel fix:\u00a0 \u00a0 \u00a0 PR #21684\nPoC packaging:\u00a0 \u00a0Jonathan Brossard (@endrazine) \u2014 MOABI / PSIRT.com"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:29:45Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/item/1384fbeb9f552591ec08d7f26df654c9489b7b6495d63c9320a15f8698c581bb"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@bugtraq.ai/message/FWH3Y6IDMATSM2C67YAGQBZKS7K6HRIT/"
        },
        {
          "url": "https://github.com/endrazine/rocq-cve-poc-21682"
        },
        {
          "url": "https://github.com/rocq-prover/rocq/issues/21682"
        },
        {
          "url": "https://github.com/rocq-prover/rocq/pull/21684"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72703"
        },
        {
          "url": "https://www.vulncheck.com/advisories/rocq-prover-before-guard-checker-accepts-non-terminating-fixpoint-via-unchecked-cross-calls"
        }
      ],
      "source": {
        "defect": [
          "4c3087fb-e79b-4740-b8ce-6d9ac36555c4%40gmail.com"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Bugtraq] CVE-2026-72703: Rocq guard checker accepts non-terminating fixpoint via unchecked cross-calls (0 = 1 demonstrated)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-72703",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0443",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/item/1384fbeb9f552591ec08d7f26df654c9489b7b6495d63c9320a15f8698c581bb",
            "automated": true,
            "contentSha256": "1384fbeb9f552591ec08d7f26df654c9489b7b6495d63c9320a15f8698c581bb",
            "evidenceScore": 10,
            "messageId": "4c3087fb-e79b-4740-b8ce-6d9ac36555c4%40gmail.com",
            "originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@bugtraq.ai/message/FWH3Y6IDMATSM2C67YAGQBZKS7K6HRIT/",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-11-02T07:29:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0443"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:29:45Z",
    "dateUpdated": "2026-11-02T07:29:45Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0443"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.