Zero Radar
← feed
HighVulnerabilityCVE-2026-72714updated 26 Oct 2026, 02:37 UTC

Rocq proof checker can accept false proofs after a module closes

The Rocq proof assistant, used to check math and software proofs, can be tricked into accepting a proof of a false statement such as 0 = 1. This means a 'verified' proof may be wrong without any warning.

No fix yetOfficial, 3 sources
SeverityHighCVSS 6.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Module disables checkLocal Unset Universe Checking used inside a module
  2. 2Module closesGlobal flag restored, universe graph copy left disabled
  3. 3Kernel accepts bad termsUniverse constraints no longer enforced
  4. 4Proof of False derivedHurkens' paradox yields 0 = 1
  5. ResultFalse proofs accepted as valid

What happened

After a module that locally disabled universe checking is closed, the universe graph keeps its own copy of the flag set to disabled, while the global flag is restored. The kernel then accepts universe-inconsistent terms, which lets Hurkens' paradox yield a proof of False.

Why it is dangerous: Proofs that rely on Rocq can be silently unsound, so anyone trusting machine-checked results (researchers, formal verification users, teams relying on verified code) may accept false claims. Print Assumptions and the flag query both report the state as normal, so the problem is hard to notice.

Are you affected?

You are affected if you use the Rocq Prover (formerly Coq) and your development contains modules that use Local Unset Universe Checking.

Rocq Prover (formerly Coq); exact affected versions unknown.

What to do

  1. Avoid using Local Unset Universe Checking inside modules until a fix is released
  2. Check the Rocq project and GitHub advisory GHSA-95gm-3748-rx8v for an updated version and apply it when available
  3. Re-verify important proofs with an independent checker or review results that depend on modules disabling universe checking

Timeline

  1. 24 Aug 2026, 20:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 00:21 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 00:31 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 02:23 UTC
    NVD reported on it · NVD
  5. 26 Oct 2026, 02:37 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-72714 · GHSA-95gm-3748-rx8v
CVSS
6.8 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
24 Aug 2026, 20:17 UTC
On Zero Radar
26 Oct 2026, 00:31 UTC (62 days after disclosure)
Last change
26 Oct 2026, 02:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Rocq proof checker can accept false proofs after a module closes · Zero Radar