78 matches found
lean-cve-poc
CVE-2026-72844: Error de solidez del kernel de Lean 4 Demostrando0 = 1 sin axiomas mediante la evasión de la validación de proyecciones inductivas anidadas. Campo| Valor ---|--- CVE| CVE-2026-72844 Aviso| VulnCheck VCSA Informe de error| leanprover/lean414576 Corrección| leanprover/lean414577...
CVE-2026-72703
The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. finduniformparameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes th...
CVE-2026-72711
The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...
CVE-2026-72705
CVE-2026-72705 is a soundness flaw in the guard checker of Rocq Prover (before 9.2.0). The checker fails to track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint, which then applies it to a non-subterm value. This admits a type definitionally equal to ...
CVE-2026-72704 Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because...
PT-2026-81018
The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because...
SP1 V6 Recursion Circuit Row-Count Binding Gap
Summary A soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. - Affected versions: = 6.0.0, = 6.0.2 - Not affected: SP1 V5 all versions - Severity: High Details Background...
EUVD-2021-1543
Malware in sbrugna...
EUVD-2021-1916
Malware in sbrugna...
EUVD-2021-1744
Malware in sbrugna...
EUVD-2021-1525
Malware in sbrugna...
EUVD-2021-1806
Malware in sbrugna...
EUVD-2021-1521
Malware in sbrugna...
EUVD-2021-1549
Malware in sbrugna...
EUVD-2021-1535
Malware in sbrugna...
EUVD-2021-1920
Malware in sbrugna...
EUVD-2021-1523
Malware in sbrugna...
CVE-2021-26957
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::changeproperty, as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server...