CVE-2026-72705 rocq-prover CVE debrief

Who should care

Defenders responsible for the Rocq Prover environment should assess exposure and verify the presence of the fixed version. This includes reviewing the configuration and usage of fixpoints, monitoring for potential issues, and ensuring that compensating controls are in place for exposed systems. Security teams and vulnerability management teams should prioritize verifying the environment and planning for updates or mitigations.

Why it matters

The vulnerability in Rocq Prover's guard checker allows for a specific type of logical issue, requiring verification of the environment and configuration to determine exposure and potential impact.

• Verification of Rocq Prover version and configuration is required to determine exposure.
• Potential for logical issues or incorrect results in purely definitional code.

Technical summary

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments, allowing a type that is definitionally equal to its own negation. This occurs because higher-order recursive calls through fixpoint arguments are not tracked. As a result, self-application can produce False in purely definitional code without tactics, axioms, plugins, or unsafe flags. The fix involves updating to Rocq 9.2.0, which addresses this issue by enhancing the tracking of recursive calls through fixpoints.

Defensive priority

Defenders should prioritize verifying the presence of Rocq 9.2.0 or later in their environment.

Recommended defensive actions

• Verify the version of Rocq Prover in use and upgrade to 9.2.0 or later if necessary.
• Review the configuration and usage of fixpoints in the Rocq Prover environment.
• Monitor for any potential issues or anomalies related to the guard checker.
• Perform a thorough review of the environment to identify any exposed systems.
• Develop compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Ensure that relevant monitoring, detection, and logs are reviewed for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its impact and exploitation require further verification. The issue is related to the guard checker's behavior with recursive calls through fixpoint arguments. To assess exposure, defenders should verify the Rocq Prover version and configuration. The vulnerability's impact on operational security and potential anomalies needs careful monitoring.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.