CVE-2026-72704 Overview
CVE-2026-72704 is a soundness flaw in the Rocq Prover (formerly Coq) guard checker. The guard checker fails to recheck the recursive tree representation of an inductive type parameter after that parameter is changed by transport. An attacker who crafts a proof development can construct a non-terminating fixpoint that the checker accepts as structurally decreasing. The resulting definition proves False, which allows any proposition to be derived. The demonstration relies only on axioms consistent with the calculus of inductive constructions, so the contradiction originates from the guard check itself and not from user assumptions. This category is tracked as [CWE-670] Always-Incorrect Control Flow Implementation.
Critical Impact
A crafted Rocq development can derive False and prove arbitrary propositions, breaking the logical soundness that dependent-type proof assistants rely on for verification.
Affected Products
- Rocq Prover (upstream repository at rocq-prover/rocq)
- Formerly branded Coq Proof Assistant
- Downstream developments and libraries that depend on the guard checker for soundness
Discovery Timeline
- 2026-08-24 - CVE-2026-72704 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-72704
Vulnerability Analysis
Rocq's termination check relies on a recursive tree annotation attached to each inductive parameter. This tree tells the guard checker which subterms are strictly smaller than the recursive argument. The vulnerability appears when a fixpoint rewrites its recursive argument along an equality between types. Because the inductive type is preserved by the rewrite, the guard checker accepts the transport. However, the recorded recursive tree for the parameter is silently altered.
A second fixpoint that calls the first inherits this corrupted recursive tree without any re-verification. A recursive call that is not structurally decreasing then passes the check as if it were terminating. The accepted fixpoint runs forever at the type level, allowing a proof that a natural number equals its own successor. From n = S n the developer derives False, and from False any proposition follows by ex falso quodlibet. The two axioms used in the demonstration follow from univalence and are consistent with the calculus of inductive constructions, so the flaw is confined to the guard-checking logic.
Root Cause
The guard checker treats the recursive tree attached to an inductive parameter as trusted after transport. It validates the outer type constructor but does not re-derive the recursive tree from the post-transport parameter. This is a control-flow correctness defect, classified as [CWE-670].
Attack Vector
Exploitation is local and requires user interaction: a developer, reviewer, or continuous integration system must load or check a crafted .v file. There is no network reach and no elevated privilege requirement, but a malicious library, tutorial file, or pull request can silently introduce an inconsistent axiom-free proof of False into a downstream project.
A public proof-of-concept development is published at the rocq-cve-poc-22024 repository, and additional analysis is available in the VulnCheck advisory. See issue #22024 and the proposed fix in pull request #22027 for the mechanics.
Detection Methods for CVE-2026-72704
Indicators of Compromise
- Rocq source files containing fixpoints that apply eq_rect, eq_rec, or explicit transport to the recursive argument before a recursive call.
- Developments that pair a rewrite along a type equality with a second fixpoint calling the first, especially when the inner fixpoint claims structural decrease on the rewritten argument.
- Proofs that terminate in False or in an equality of the form n = S n without any user-declared axioms beyond those consistent with univalence.
Detection Strategies
- Audit third-party Rocq libraries and pull requests for uses of transport on recursive arguments before merging.
- Run proofs under a version of Rocq that includes the fix from PR #22027 and treat any newly rejected proof as a candidate for review.
- Use Print Assumptions on top-level theorems to confirm that only expected axioms are in use and to flag definitions that reach False.
Monitoring Recommendations
- Track the upstream Rocq repository and the linked issue and pull request for merge status of the proposed fix.
- Alert on additions of new fixpoints that consume equalities between types as arguments during code review.
- Include soundness regression checks in continuous integration for verification projects that ship compiled Rocq artifacts.
How to Mitigate CVE-2026-72704
Immediate Actions Required
- Restrict the ingestion of untrusted Rocq developments and libraries until a fixed release is available.
- Review any recent code that transports the recursive argument of a fixpoint along a type equality.
- Re-run Print Assumptions on critical theorems to verify no unintended axioms or contradictions have entered the trusted base.
Patch Information
A fix has been proposed in pull request #22027 against the Rocq Prover repository but was not merged at the time of publication. Track the upstream issue #22024 for the release that incorporates the fix, and upgrade once a tagged version is available.
Workarounds
- Avoid fixpoints whose recursive argument is produced by transport across a type equality; refactor such definitions to perform the rewrite outside the recursive call.
- Vendor and pin a known-good Rocq toolchain in continuous integration so that unreviewed language changes cannot affect proof soundness.
- Require code review for any use of eq_rect-family lemmas on the decreasing argument of a fixpoint in shared libraries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
