Rocq: soundness bug

rocq-prover rocq

Rocq kernel's guard checker trusts corrupted recursive tree after transport, allowing arbitrary propositions.

Do this now

Take Rocq proof checking offline or restrict who can submit proof files until the vendor's advisory names a fix, since no fix exists yet.

Still cooking for rocq-prover rocq.

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 00:18 UTC
Identifiers: CVE-2026-72704
CVSS: 6.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Rocq: soundness bug
Severity: medium. Patch status: no fix yet.
Affected: rocq-prover rocq
Ids: CVE-2026-72704

Rocq kernel's guard checker trusts corrupted recursive tree after transport, allowing arbitrary propositions.

## Steps
1. Search the repo, its CI and infra config for rocq-prover rocq. If present, report the version in use and whether it's affected.
2. rocq-prover rocq <= 9.2.0: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| rocq-prover rocq <= 9.2.0 | not named in the CVE record | check the vendor advisory | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-72704") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/382
https://pwned.coffee/i/rocq-soundness-bug-cve-2026-72704

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-72704 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
rocq-prover rocq <= 9.2.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 26 Oct
Score: CVSS 6.3 (medium). CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2026-72704
Last checked: 26 Oct 2026, 02:17 UTC

Product	Affected	Fixed in	Source
rocq-prover rocq	<= 9.2.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day

Totalone coffee