Rocq: soundness bug

rocq-prover rocq

Rocq kernel's guard checker allows construction of a checked proof of False, enabling arbitrary propositions.

Do this now

Take Rocq proof checking offline or restrict who can submit proof files until the vendor's advisory names a fix, since no fix exists yet.

Still cooking for rocq-prover rocq.

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 01:17 UTC
Identifiers: CVE-2020-37268
CVE-2026-72703
CVE-2026-72705
CVE-2026-72714
CVSS: 6.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Rocq: soundness bug
Severity: medium. Patch status: no fix yet.
Affected: rocq-prover rocq
Ids: CVE-2020-37268, CVE-2026-72703, CVE-2026-72705, CVE-2026-72714

Rocq kernel's guard checker allows construction of a checked proof of False, enabling arbitrary propositions.

## Steps
1. Search the repo, its CI and infra config for rocq-prover rocq. If present, report the version in use and whether it's affected.
2. rocq-prover rocq <= 9.2.0: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| rocq-prover rocq <= 9.2.0 | not named in the CVE record | check the vendor advisory | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2020-37268") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/381 https://seclists.org/oss-sec/2026/q4/383 https://seclists.org/oss-sec/2026/q4/384 https://seclists.org/oss-sec/2026/q4/385
https://pwned.coffee/i/rocq-soundness-bug-cve-2026-72703

Timeline

26 Oct 2026, 01:17 UTC
Unfixed since 2020, Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline.
26 Oct 2026, 01:17 UTC
Rocq universe checking state desynchronised after module close, another instance of soundness bug.
26 Oct 2026, 01:17 UTC
Another instance of Rocq soundness bug, where guard checker accepts fixpoint passed as higher-order argument.
26 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2020-37268 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
rocq-prover rocq <= 9.2.0 9.2.0 closes CVE-2026-72703, CVE-2026-72705 only; CVE-2020-37268 needs a fix its CVE record doesn’t name; CVE-2026-72714 needs a fix its CVE record doesn’t name CVE record (CNA) checked 26 Oct
Score: CVSS 6.3 (medium). CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2020-37268
Last checked: 26 Oct 2026, 02:17 UTC

Product	Affected	Fixed in	Source
rocq-prover rocq	<= 9.2.0	9.2.0 closes CVE-2026-72703, CVE-2026-72705 only; CVE-2020-37268 needs a fix its CVE record doesn’t name; CVE-2026-72714 needs a fix its CVE record doesn’t name	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone coffee