lean-cve-poc

CVE-2026-72844: Lean 4 Kernel Soundness Bug Proving0 = 1 axiom-free via nested inductive projection validation bypass...

CVE-2026-72711

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72703

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. finduniformparameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes th...

CVE-2026-72705

CVE-2026-72705 is a soundness flaw in the guard checker of Rocq Prover (before 9.2.0). The checker fails to track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint, which then applies it to a non-subterm value. This admits a type definitionally equal to ...

CVE-2026-72704 Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because...

SP1 V6 Recursion Circuit Row-Count Binding Gap

Summary A soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. - Affected versions: = 6.0.0, = 6.0.2 - Not affected: SP1 V5 all versions - Severity: High Details Background...

EUVD-2021-1916

Malware in sbrugna...

EUVD-2021-1744

Malware in sbrugna...

EUVD-2021-1543

Malware in sbrugna...

EUVD-2021-1535

Malware in sbrugna...

EUVD-2021-1525

Malware in sbrugna...

EUVD-2021-1549

Malware in sbrugna...

EUVD-2021-1920

Malware in sbrugna...

EUVD-2021-1806

Malware in sbrugna...

EUVD-2021-1521

Malware in sbrugna...

EUVD-2021-1523

Malware in sbrugna...

CVE-2021-26957

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::changeproperty, as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server...

CVE-2021-26308

An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness...

CVE-2021-38187

An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a u8 to a u64...

CVE-2021-26956

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value...