Vulnerability-Lookup

GCVE-1988-2026-0447

Vulnerability from gna-1988 – Published: 2026-11-02 07:29 – Updated: 2026-11-02 07:29

Title

[Bugtraq] CVE-2020-37268: Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline (0 = 1 demonstrated) — unfixed since 2020

Summary

1. Summary ========== A soundness-audit bypass in the Rocq (formerly Coq) module system allows construction of a proof of False that Print Assumptions reports as closed under the global context — no axioms, no unsafe flags visible. When a module type declares Parameter Inline and functor application inlines the parameter's body, the metadata recording that the original definition was produced under Unset Universe Checking is dropped. Print Assumptions therefore sees no trace of the unsafe context, while the universe graph silently accepts inconsistent universe constraints from the inlined body. This allows Girard's / Hurkens' paradox to prove False via universe polymorphism. coqchk does reject the resulting compiled .vo file, but the in-process assumption audit (Print Assumptions) — the tool most Rocq/Coq users rely on — does not catch the issue. This bug has been open since 2020 and is documented in the project's own dev/doc/critical-bugs.md. No fix has been merged as of Rocq 9.2.0. 2. Context ========== Rocq (formerly Coq) is the reference implementation of the Calculus of Inductive Constructions and one of the most widely deployed proof assistants. Print Assumptions is the standard command users and CI pipelines run to verify that a proof does not depend on axioms or unsafe flags. It is the primary integrity check in most Rocq/Coq workflows. A bypass that makes Print Assumptions report a universe-inconsistent proof as clean undermines the trust model at the workflow level: the kernel itself is not unsound, but the tool users rely on to audit proofs produces silently incorrect output. Formally verified systems certified under Common Criteria (ISO 15408) or DO-178C (airborne software) that use Print Assumptions as part of their verification chain are affected. 3. Impact ========= - Any workflow that relies on Print Assumptions as the sole integrity check — which is the default for most Rocq/Coq projects - Formally verified compilers (CompCert) - Verified OS kernels (CertiKOS) - Separation logic frameworks (Iris) - Mathematical libraries (MathComp) - Proof-carrying code: a malicious .v file in a dependency could introduce unsound declarations that pass assumption auditing - Verified smart contracts (ConCert) - Any project not routinely running coqchk on compiled output 4. Proof of Concept =================== A Docker-reproducible PoC is available: git clone https://github.com/endrazine/rocq-cve-poc-12155 cd rocq-cve-poc-12155 docker build -t rocq-cve-poc-12155 . docker run --rm rocq-cve-poc-12155 On a vulnerable version (Rocq 8.11 – 9.2.0, all Coq 8.x with the module system), the output confirms the proof of 0 = 1 with Print Assumptions reporting it as closed (no axioms, no unsafe flags). 5. Root Cause ============= When a module type declares Parameter Inline, functor application inlines the parameter's body into the calling context. This inlining discards the metadata recording that the original definition was produced under Unset Universe Checking. The universe graph therefore accepts inconsistent universe constraints from the inlined body, and Print Assumptions sees no trace of the unsafe context. CWE-778: Insufficient Logging — the assumption-tracking subsystem fails to record the safety-critical flag state through the module inlining path. 6. Scoring ========== CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N — 7.1 (High) CVSS 4.0: AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N — 6.8 (Medium) 7. CWE ====== CWE-778: Insufficient Logging 8. CVE ====== CVE-2020-37268 (assigned by VulnCheck as CNA) 9. Affected Versions ==================== Coq 8.11 – 8.20 (all versions with the module system) Rocq Prover 8.20 – 9.2.0 Fixed in: UNFIXED as of Rocq 9.2.0. 10. Mitigation ============== - No patched version is available. - Run coqchk on all compiled .vo files before trusting proofs in production — coqchk catches the universe inconsistency that Print Assumptions misses. - Audit module dependencies for use of Parameter Inline compiled under Unset Universe Checking. 11. References ============== Bug report: https://github.com/rocq-prover/rocq/issues/12155 Critical bugs: https://github.com/rocq-prover/rocq/blob/master/dev/doc/critical-bugs.md PoC: https://github.com/endrazine/rocq-cve-poc-12155 VulnCheck: https://www.vulncheck.com/advisories/coq-and-rocq-prover-print-assumptions-o... NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-37268 12. Timeline ============ 2020 Bug reported by Jason Gross (coq/coq#12155) 2020–2026 Bug remains open, documented in critical-bugs.md 2026-08-24 CVE-2020-37268 published by VulnCheck 2026-08-24 Docker-reproducible PoC published 13. Credit ========== Bug discovery: Jason Gross PoC packaging: Jonathan Brossard (@endrazine) — MOABI / PSIRT.com

Severity

No CVSS data available.

CWE

CWE-778

Assigner

VULNARCHIVE GNA GNA-1988

GNA scorecard E 38/100 over 556 records in the last 180 days details

References

7 references

URL	Tags
https://vuln.freearchive.org/archive/item/2e2d063…	technical-descriptionexploit
https://lists.securityfocus.com/hyperkitty/list/b…	technical-description
https://github.com/endrazine/rocq-cve-poc-12155
https://github.com/rocq-prover/rocq/blob/master/d…
https://github.com/rocq-prover/rocq/issues/12155
https://nvd.nist.gov/vuln/detail/CVE-2020-37268
https://www.vulncheck.com/advisories/coq-and-rocq…

Impacted products

1 product

Vendor	Product	Version	CPE status
rocq-prover	rocq	Affected: unknown	guessed

Credits

Jonathan Brossard

Relationships

analysis GCVE-1988-2026-0447 (this record)

related CVE-2020-37268

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rocq",
          "vendor": "rocq-prover",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonathan Brossard"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. Summary\n==========\nA soundness-audit bypass in the Rocq (formerly Coq) module system\nallows construction of a proof of False that Print Assumptions reports\nas closed under the global context \u2014 no axioms, no unsafe flags visible.\nWhen a module type declares Parameter Inline and functor application\ninlines the parameter\u0027s body, the metadata recording that the original\ndefinition was produced under Unset Universe Checking is dropped. Print\nAssumptions therefore sees no trace of the unsafe context, while the\nuniverse graph silently accepts inconsistent universe constraints from\nthe inlined body. This allows Girard\u0027s / Hurkens\u0027 paradox to prove\nFalse via universe polymorphism.\ncoqchk does reject the resulting compiled .vo file, but the in-process\nassumption audit (Print Assumptions) \u2014 the tool most Rocq/Coq users\nrely on \u2014 does not catch the issue.\nThis bug has been open since 2020 and is documented in the project\u0027s\nown dev/doc/critical-bugs.md. No fix has been merged as of Rocq 9.2.0.\n2. Context\n==========\nRocq (formerly Coq) is the reference implementation of the Calculus of\nInductive Constructions and one of the most widely deployed proof\nassistants. Print Assumptions is the standard command users and CI\npipelines run to verify that a proof does not depend on axioms or unsafe\nflags. It is the primary integrity check in most Rocq/Coq workflows.\nA bypass that makes Print Assumptions report a universe-inconsistent\nproof as clean undermines the trust model at the workflow level: the\nkernel itself is not unsound, but the tool users rely on to audit proofs\nproduces silently incorrect output.\nFormally verified systems certified under Common Criteria (ISO 15408) or\nDO-178C (airborne software) that use Print Assumptions as part of their\nverification chain are affected.\n3. Impact\n=========\n- Any workflow that relies on Print Assumptions as the sole integrity\ncheck \u2014 which is the default for most Rocq/Coq projects\n- Formally verified compilers (CompCert)\n- Verified OS kernels (CertiKOS)\n- Separation logic frameworks (Iris)\n- Mathematical libraries (MathComp)\n- Proof-carrying code: a malicious .v file in a dependency could\nintroduce unsound declarations that pass assumption auditing\n- Verified smart contracts (ConCert)\n- Any project not routinely running coqchk on compiled output\n4. Proof of Concept\n===================\nA Docker-reproducible PoC is available:\ngit clone https://github.com/endrazine/rocq-cve-poc-12155\ncd rocq-cve-poc-12155\ndocker build -t rocq-cve-poc-12155 .\ndocker run --rm rocq-cve-poc-12155\nOn a vulnerable version (Rocq 8.11 \u2013 9.2.0, all Coq 8.x with the\nmodule system), the output confirms the proof of 0 = 1 with Print\nAssumptions reporting it as closed (no axioms, no unsafe flags).\n5. Root Cause\n=============\nWhen a module type declares Parameter Inline, functor application\ninlines the parameter\u0027s body into the calling context. This inlining\ndiscards the metadata recording that the original definition was\nproduced under Unset Universe Checking. The universe graph therefore\naccepts inconsistent universe constraints from the inlined body, and\nPrint Assumptions sees no trace of the unsafe context.\nCWE-778: Insufficient Logging \u2014 the assumption-tracking subsystem\nfails to record the safety-critical flag state through the module\ninlining path.\n6. Scoring\n==========\nCVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N \u2014 7.1 (High)\nCVSS 4.0: AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N \u2014 6.8\n(Medium)\n7. CWE\n======\nCWE-778: Insufficient Logging\n8. CVE\n======\nCVE-2020-37268 (assigned by VulnCheck as CNA)\n9. Affected Versions\n====================\nCoq 8.11 \u2013 8.20 (all versions with the module system)\nRocq Prover 8.20 \u2013 9.2.0\nFixed in: UNFIXED as of Rocq 9.2.0.\n10. Mitigation\n==============\n- No patched version is available.\n- Run coqchk on all compiled .vo files before trusting proofs in\nproduction \u2014 coqchk catches the universe inconsistency that Print\nAssumptions misses.\n- Audit module dependencies for use of Parameter Inline compiled under\nUnset Universe Checking.\n11. References\n==============\nBug report:       https://github.com/rocq-prover/rocq/issues/12155\nCritical bugs:\nhttps://github.com/rocq-prover/rocq/blob/master/dev/doc/critical-bugs.md\nPoC:              https://github.com/endrazine/rocq-cve-poc-12155\nVulnCheck:\nhttps://www.vulncheck.com/advisories/coq-and-rocq-prover-print-assumptions-o...\nNVD:              https://nvd.nist.gov/vuln/detail/CVE-2020-37268\n12. Timeline\n============\n2020        Bug reported by Jason Gross (coq/coq#12155)\n2020\u20132026   Bug remains open, documented in critical-bugs.md\n2026-08-24  CVE-2020-37268 published by VulnCheck\n2026-08-24  Docker-reproducible PoC published\n13. Credit\n==========\nBug discovery:   Jason Gross\nPoC packaging:   Jonathan Brossard (@endrazine) \u2014 MOABI / PSIRT.com"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:29:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/item/2e2d0639c85a38a0f3fd0374d648e1cc4beeed83bb7b1d2eece84cd3ad4706bc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@bugtraq.ai/message/4V2CUCS3QXJYDNRTCOIZ6JUAGSVILKEY/"
        },
        {
          "url": "https://github.com/endrazine/rocq-cve-poc-12155"
        },
        {
          "url": "https://github.com/rocq-prover/rocq/blob/master/dev/doc/critical-bugs.md"
        },
        {
          "url": "https://github.com/rocq-prover/rocq/issues/12155"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37268"
        },
        {
          "url": "https://www.vulncheck.com/advisories/coq-and-rocq-prover-print-assumptions-omits-unsafe-universe-checking-inlined-through-parameter-inline"
        }
      ],
      "source": {
        "defect": [
          "4ac7b1ae-2514-47a1-b751-3be80c388a1b%40gmail.com"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Bugtraq] CVE-2020-37268: Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline (0 = 1 demonstrated) \u2014 unfixed since 2020",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2020-37268",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0447",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/item/2e2d0639c85a38a0f3fd0374d648e1cc4beeed83bb7b1d2eece84cd3ad4706bc",
            "automated": true,
            "contentSha256": "2e2d0639c85a38a0f3fd0374d648e1cc4beeed83bb7b1d2eece84cd3ad4706bc",
            "evidenceScore": 10,
            "messageId": "4ac7b1ae-2514-47a1-b751-3be80c388a1b%40gmail.com",
            "originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@bugtraq.ai/message/4V2CUCS3QXJYDNRTCOIZ6JUAGSVILKEY/",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-11-02T07:29:48Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0447"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:29:48Z",
    "dateUpdated": "2026-11-02T07:29:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0447"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-37268 (GCVE-0-2020-37268)

Vulnerability from cvelistv5 – Published: 2026-08-24 20:08 – Updated: 2026-10-26 01:23

Title

Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline

Summary

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built under Unset Universe Checking, so the resulting constant carries no trace of the unsafe operation. A module implementation can therefore prove False using a universe inconsistency, expose it through an inlined parameter, and have Print Assumptions report the dependent proof as closed under the global context. Because Print Assumptions is the in-process audit used to confirm that a development rests on no unexpected assumptions, a dependency built this way passes that audit while proving arbitrary propositions. The standalone checker coqchk does reject the resulting compiled file. The project records this in dev/doc/critical-bugs.md under non-fixed bugs and rates the risk as moderate when coqchk is not used.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:10 UTC

CWE

CWE-778 - Insufficient Logging

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7611 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/rocq-prover/rocq	product
https://github.com/rocq-prover/rocq/issues/12155	issue-tracking
https://github.com/rocq-prover/rocq/blob/master/d…	technical-description
https://github.com/endrazine/rocq-cve-poc-12155	exploit
https://www.vulncheck.com/advisories/coq-and-rocq…	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/26/8

Impacted products

1 product

Vendor	Product	Version
rocq-prover	rocq	Affected: 8.11 , ≤ 9.2.0 (custom)

Date Public

2020-04-22 00:00

Credits

Jason Gross Jonathan Brossard (MOABI)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-37268",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:10:38.394659Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:10:45.964Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rocq-prover/rocq/issues/12155"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-26T01:23:51.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/rocq-prover/rocq",
          "product": "rocq",
          "repo": "https://github.com/rocq-prover/rocq",
          "vendor": "rocq-prover",
          "versions": [
            {
              "lessThanOrEqual": "9.2.0",
              "status": "affected",
              "version": "8.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jason Gross"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonathan Brossard (MOABI)"
        }
      ],
      "datePublic": "2020-04-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built under Unset Universe Checking, so the resulting constant carries no trace of the unsafe operation. A module implementation can therefore prove False using a universe inconsistency, expose it through an inlined parameter, and have Print Assumptions report the dependent proof as closed under the global context. Because Print Assumptions is the in-process audit used to confirm that a development rests on no unexpected assumptions, a dependency built this way passes that audit while proving arbitrary propositions. The standalone checker coqchk does reject the resulting compiled file. The project records this in dev/doc/critical-bugs.md under non-fixed bugs and rates the risk as moderate when coqchk is not used."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:17:14.561Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/rocq-prover/rocq"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/rocq-prover/rocq/issues/12155"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/rocq-prover/rocq/blob/master/dev/doc/critical-bugs.md"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/endrazine/rocq-cve-poc-12155"
        },
        {
          "name": "VulnCheck Advisory: Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/coq-and-rocq-prover-print-assumptions-omits-unsafe-universe-checking-inlined-through-parameter-inline"
        }
      ],
      "title": "Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2020-37268",
    "datePublished": "2026-08-24T20:08:28.079Z",
    "dateReserved": "2026-08-19T11:37:41.053Z",
    "dateUpdated": "2026-10-26T01:23:51.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted