All vulnerabilities
CVE-2026-72714

Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

rocq-prover rocq
CVSS
6.8Medium
ExploitationExploitation reported2 outlets report it, first 26 Oct 2026. Not yet in the KEV catalogReports
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 25 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Aug 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 24 Aug 2026, 20:08 UTCPublishedCVE List
  2. 26 Oct 2026, 00:21 UTCFirst reported exploitedoss-security
  3. NowNot on CISA's known exploited list yet

Reports 2

2 outlets report exploitation. Reports are not confirmation; each links to its source.

Description

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps its own copy which is left disabled. The two views then disagree: Test Universe Checking reports the check as enabled while the kernel continues to accept universe-inconsistent terms. With the constraint between two universes no longer enforced, Hurkens' paradox applies and yields a proof of False, from which any proposition follows. The proof uses no axioms, plugins or unsafe features once the module has closed, and Print Assumptions reports it as closed under the global context, so neither the assumption audit nor the flag query reflects the actual kernel state. No fix is available.

Text from CVE List

Affected versions 1

  • rocqaffected: all versions through 9.2.0CVE List

References 4