rocq-cve-poc-12155

CVE-2020-37268 — Rocq/Coq Print Assumptions Omits Unsafe Universe Checking via Parameter Inline Bypassing the proof audit via module functor inlining — unfixed since 2020. Vulnerability Summary Print Assumptions fails to report that a definition was built with universe checking disabled when that...

rocq-cve-poc-22287

CVE-2026-72714 — Rocq Universe Checking State Desynchronised After Module Close Proving0 = 1 axiom-free via module-scoped universe checking flag desynchronization. Field| Value ---|--- Bug report| rocq-prover/rocq22287 Fix| None issue open as of 2026-08-16 Affected| Rocq ≤ 9.2.0 / Coq 8.x all...

rocq-cve-poc-21683

CVE-2026-72705 — Rocq Guard Checker Accepts Fixpoint Passed as Higher-Order Argument Proving0 = 1 axiom-free via Russell's paradox through guard checker fixpoint bypass. Discovered autonomously by Claude Opus 4.6 Anthropic. Field| Value ---|--- Bug report| rocq-prover/rocq21683 Fix| PR 21684...

rocq-cve-poc-22024

CVE-2026-72704 — Rocq Guard Checker Trusts Corrupted Recursive Tree After Transport Proving0 = 1 from consistent axioms via guard checker fixpoint rectree corruption. Field| Value ---|--- Bug report| rocq-prover/rocq22024 Fix| PR 22027 open Affected| Rocq ≤ 9.2.0 / Coq 8.x all versions with guard...

rocq-cve-poc-21682

CVE-2026-72703 — Rocq Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls Proving0 = 1 axiom-free via guard checker uniform parameter bypass. Vulnerability Summary The Rocq kernel's guard checker fixpoint termination verifier treats all parameters of a nested mutual fixpoint ...

...[ More ]

Coq versions 8.11 through 8.20 and Rocq Prover versions through 9.2.0 contain a proof auditing vulnerability involving the Parameter Inline mechanism in module functors. Definitions created with universe checking disabled can be inlined without preserving the unsafe universe checking metadata,...

Rocq Prover 9.1.0 Higher Order Fixpoint Guard Checker Bypass

Rocq Prover version 9.1.0 and earlier contain a kernel soundness vulnerability in the termination guard checker. The checker incorrectly accepts recursive functions passed as higher order arguments to other fixpoints, allowing recursive calls on values that are not structurally decreasing. This...

Rocq Prover 9.1 Guard Checker Bypass Proof of Concept

Rocq Prover versions 8.20 through 9.1 contain a kernel soundness vulnerability in the termination guard checker. The finduniformparameters function fails to examine cross-calls between nested mutually recursive fixpoints, incorrectly treating changing parameters as uniform and accepting recursive...

...[ More ]

Rocq Prover versions up to and including 9.2.0 contain a kernel soundness vulnerability in the termination guard checker. Recursive functions involving type transport through the rew construct can corrupt the internal recursive argument tree representation, allowing subsequent fixpoints to be...

Rocq Prover 9.2.0 Universe Checking Bypass Proof of Concept

Rocq Prover versions up to and including 9.2.0 contain a kernel soundness vulnerability caused by improper restoration of universe checking state when a module closes. The Local Unset Universe Checking directive can leave the kernel's universe graph with validation disabled even after the global...

FVQKD: A Formal Verification of Quantum Key Distribution Security in Rocq

Quantum key distribution QKD, whose security is derived from quantum mechanics rather than computational assumptions, is moving into standardization and commercial deployment. Yet its security guarantees rest on technically delicate proofs checked by hand. Formal verification closes this gap,...

[SECURITY] Fedora 44 Update: rocq-stdlib-9.2.0-1.fc44

Rocq is a formal proof management system. It provides a formal language to write mathematical definitions, executable algorithms and theorems together with an environment for semi-interactive development of machine-checked proof s. This package includes the Rocq Standard Library, that is to say,...

[SECURITY] Fedora 44 Update: rocq-9.3.0-1.fc44

Rocq is a formal proof management system. It provides a formal language to write mathematical definitions, executable algorithms and theorems together with an environment for semi-interactive development of machine-checked proof s. Typical applications include the certification of properties of...

Fedora 44 : flocq / gappalib-coq / rocq / rocq-stdlib / why3 / zenon (2026-62bbabcf11)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-62bbabcf11 advisory. See https://rocq-prover.org/doc/v9.3/refman/changes.htmlversion-9-3 for changes in rocq 9.3.0. See...

[SECURITY] Fedora 45 Update: rocq-stdlib-9.2.0-1.fc45

Rocq is a formal proof management system. It provides a formal language to write mathematical definitions, executable algorithms and theorems together with an environment for semi-interactive development of machine-checked proof s. This package includes the Rocq Standard Library, that is to say,...

[SECURITY] Fedora 45 Update: rocq-9.3.0-2.fc45

Rocq is a formal proof management system. It provides a formal language to write mathematical definitions, executable algorithms and theorems together with an environment for semi-interactive development of machine-checked proof s. Typical applications include the certification of properties of...

Fedora 45 : 0install / alt-ergo / apron / brltty / coccinelle / etc (2026-403bcf6fd8)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-403bcf6fd8 advisory. This is a mass rebuild of the OCaml ecosystem with OCaml 5.5.1, which fixes two security bugs. See https://github.com/ocaml/ocaml/releases/tag/5.5.1...

CVE-2026-72714

A flaw was found in Rocq Prover. When a module that locally disabled the universe checking flag is closed, the prover fails to restore the universe graph's copy of this flag. This desynchronization allows the kernel to accept terms that are inconsistent with the universe, even though the system...

CVE-2026-72705

A flaw was found in Rocq Prover. The guard checker component fails to properly track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint. This oversight allows for the creation of a type that is logically equivalent to its own negation, which can lead to t...

CVE-2026-72703

A flaw was found in Rocq Prover. The guard checker incorrectly processes parameters of nested mutual fixpoints when cross-calls occur between different bodies of the fixpoint. This oversight allows the system to accept non-terminating definitions as structurally decreasing. This critical logical...