CVE-2026-72704
Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because the inductive type is preserved, while the recursive tree recorded for the parameter is altered. A second fixpoint that calls the first inherits the altered recursive tree without verification, so a call that is not structurally decreasing is accepted as terminating. The resulting non-terminating definition proves that a natural number equals its own successor and therefore False, from which any proposition follows. The demonstration uses two axioms that follow from univalence and are consistent with the calculus of inductive constructions, so the contradiction comes from the guard check rather than from the assumptions. A fix is proposed but not merged.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| VulnCheckCNA (assigner) | 3.1 | Medium6.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N |
| NVDNVD · Deferred | 4.0 | Medium6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Weakness
Affected products
- affected ≤ 9.2.0
References (6)
- https://github.com/rocq-prover/rocq (opens in a new tab)product
- https://github.com/rocq-prover/rocq/issues/22024 (opens in a new tab)issue-tracking
- https://github.com/rocq-prover/rocq/pull/22027 (opens in a new tab)issue-trackingpatch
- https://github.com/endrazine/rocq-cve-poc-22024 (opens in a new tab)exploit
- VulnCheck Advisory: Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport (opens in a new tab)third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-72704)Record last updated .