CVE-2026-72714 Overview
CVE-2026-72714 affects the Rocq Prover, a formal proof assistant formerly known as Coq. The vulnerability stems from incomplete cleanup [CWE-459] of the universe graph's internal state when a module closes. When a user issues Local Unset Universe Checking inside a module, the global flag correctly restores after the module ends, but the universe graph retains its disabled copy. The kernel then accepts universe-inconsistent terms while Test Universe Checking reports the check as enabled. This state desynchronization allows Hurkens' paradox to produce a proof of False, breaking soundness. Any proposition can be derived without axioms, plugins, or unsafe features, and Print Assumptions reports the proof as trusted.
Critical Impact
The kernel's soundness guarantee is broken. Proofs certified by Rocq under normal-looking assumption audits may derive arbitrary propositions, invalidating trust in formal verification results produced with affected versions.
Affected Products
- Rocq Prover (formerly Coq) - affected versions per issue tracker
- Downstream libraries and developments relying on kernel soundness
- CI pipelines and verification workflows using Rocq for formal proofs
Discovery Timeline
- 2026-08-24 - CVE-2026-72714 published to the National Vulnerability Database
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-72714
Vulnerability Analysis
Rocq's universe checker enforces constraints between type universes to prevent Girard-style paradoxes. The system exposes a Universe Checking flag that can be locally disabled with Local Unset Universe Checking inside a module. Two data structures track this flag: the global option state and the kernel's universe graph. When the module closes, only the global option resets. The universe graph retains its disabled copy, leaving the kernel silently in an unsafe configuration.
Root Cause
The root cause is an incomplete cleanup of persistent state [CWE-459] when a module scope terminates. The module-close routine restores the user-visible flag but omits the universe graph's mirror of that flag. This produces a Time-of-Check Time-of-Use style discrepancy between what Test Universe Checking reports and what the kernel enforces.
Attack Vector
Exploitation requires local interaction with a Rocq development. An adversary authors a library or proof file that opens a module, locally disables universe checking, closes the module, and then constructs a term exploiting Hurkens' paradox. Because Print Assumptions reports the proof as closed under the global context with no axioms, downstream users importing the library see a proof that appears trustworthy. The attack surface is any environment where users compile untrusted Rocq sources.
No synthetic exploitation code is reproduced here. A proof-of-concept is available in the GitHub PoC for CVE-22287 repository referenced in the advisory, and the tracking issue is at GitHub ROCQ Issue #22287.
Detection Methods for CVE-2026-72714
Indicators of Compromise
- Rocq source files containing Local Unset Universe Checking or Unset Universe Checking inside module bodies
- Proof developments that derive False or short proofs of unexpectedly strong propositions with empty Print Assumptions output
- Compiled .vo object files originating from modules that toggled universe checking
Detection Strategies
- Grep source trees for Universe Checking directives and review any occurrences inside modules or sections
- Recompile suspect developments with a patched Rocq build once available and compare kernel acceptance
- Audit third-party Rocq libraries pulled from opam or GitHub before including them in trusted verification workflows
Monitoring Recommendations
- Monitor CI pipelines for Rocq compilation of externally sourced proof files
- Track dependency changes in dune-project and _CoqProject files for new library imports
- Alert on additions of universe-checking directives during code review
How to Mitigate CVE-2026-72714
Immediate Actions Required
- Treat proofs produced by affected Rocq versions as untrusted until the kernel state issue is resolved upstream
- Inventory all Rocq developments in your organization and identify uses of Unset Universe Checking
- Restrict compilation of untrusted Rocq sources to isolated environments
Patch Information
According to the NVD entry and the VulnCheck Security Advisory, no fix is available at the time of publication. Track the upstream fix at the GitHub ROCQ Prover Repository and issue #22287 for patch availability.
Workarounds
- Prohibit the use of Local Unset Universe Checking inside modules across your codebase via linting or pre-commit hooks
- Require reviewers to reject any change that toggles universe checking
- Rebuild trusted proof artifacts from sources that never disable universe checking, and verify with a fresh kernel invocation after each module boundary
- Pin dependencies to audited versions and avoid pulling unreviewed Rocq libraries into verification pipelines
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
