CVE-2026-72704 rocq-prover CVE debrief

Who should care

Users of the Rocq Prover, particularly those relying on it for critical applications or proofs, should assess their exposure and verify the integrity of their proofs. Affected operators, platforms, vulnerability-management teams, and security teams should be aware of the potential impact on their systems and take necessary precautions.

Why it matters

The vulnerability in the Rocq Prover guard checker could lead to incorrect proofs, compromising the integrity of proofs generated using the prover, and potentially affecting critical applications that rely on it.

• Potential for incorrect proofs due to non-terminating definitions being accepted as terminating
• Integrity of proofs generated using the Rocq Prover may be compromised
• Critical applications relying on the prover may be affected

Technical summary

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because the inductive type is preserved, while the recursive tree recorded for the parameter is altered. This could lead to non-terminating definitions being accepted as terminating, potentially resulting in incorrect proofs. The issue arises from the guard checker not rechecking the recursive tree representation of an inductive type parameter after it has been changed by transport.

Defensive priority

Verify the integrity of proofs generated using the Rocq Prover and assess exposure in systems relying on the prover for critical applications.

Recommended defensive actions

• Verify the integrity of proofs generated using the Rocq Prover
• Assess exposure in systems relying on the prover for critical applications
• Monitor for updates on the proposed fix and its implementation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions is not explicitly stated. The vendor has proposed a fix, but it has not been merged. Affected product deployments need to be verified for exposure. Official advisories and CVE records should be reviewed for validation of affected scope, severity, and vendor guidance. Compensating controls should be considered for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.