leanprover lean4: vulnerability (public PoC)

leanprover lean4

Lean 4 kernel soundness bug allows construction of a checked proof of False without axioms or modified files

Do this now

Upgrade lean4 to 4.32.2 or later, since the kernel soundness bug lets a bogus proof of False pass checking.

Fix it

leanprover lean4

On 4.xUpgrade to leanprover lean4 4.32.2
On 4.xFix not named in the CVE record: see vendor advisory

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 00:17 UTC
Fixed in: 4.32.2
Identifiers: CVE-2026-72711
CVE-2026-72844
CVSS: 6.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## leanprover lean4: vulnerability (public PoC)
Severity: medium. Patch status: partial fix.
Affected: leanprover lean4
Fixed in: 4.32.2
Ids: CVE-2026-72711, CVE-2026-72844

Lean 4 kernel soundness bug allows construction of a checked proof of False without axioms or modified files

## Steps
1. Search the repo, its CI and infra config for leanprover lean4. If present, report the version in use and whether it's affected.
2. Fix by release line: leanprover lean4: 4.32.2. leanprover lean4 4.33.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| leanprover lean4 4.33.x | not named in the CVE record | check the vendor advisory | restrict network access to it |
| leanprover lean4 | fixed | 4.32.2 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-72711") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/379 https://seclists.org/oss-sec/2026/q4/380
https://pwned.coffee/i/lean-4-kernel-soundness-bug-cve-2026-72844

Timeline

26 Oct 2026, 00:17 UTC
Fix status: unknown → partial fix.
26 Oct 2026, 00:17 UTC
Another soundness bug in the Lean 4 kernel allows inference cache poisoning via opaque declarations
26 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-72711 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
leanprover lean4 = 4.33.0-rc1 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 26 Oct
leanprover lean4 before 4.32.2 4.32.2 CVE record (CNA) checked 26 Oct
Score: CVSS 6.3 (medium). CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2026-72711
Last checked: 26 Oct 2026, 02:17 UTC

Product	Affected	Fixed in	Source
leanprover lean4	= 4.33.0-rc1	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 26 Oct
leanprover lean4	before 4.32.2	4.32.2	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone coffee