CVE-2026-72703: Always-Incorrect Control Flow Implementation

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. finduniformparameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes th...

CVE-2026-72705: Always-Incorrect Control Flow Implementation

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

CVE-2026-72714: Incomplete Cleanup

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

PT-2026-81021

Name of the Vulnerable Software and Affected Versions Rocq Prover affected versions not specified Description The software fails to restore the universe graph's copy of the universe checking flag after a module that locally disabled the check is closed. While the global flag is restored, the...

PT-2026-81017

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. find uniform parameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes...

PT-2026-81018

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because...

PT-2026-81019

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

Nonmalleable Progress Leakage

Information-flow control systems often enforce progress-insensitive noninterference, as it is simple to understand and enforce. Unfortunately, real programs need to declassify results and endorse inputs, which noninterference disallows, while preventing attackers from controlling leakage, includi...