CVE-2026-72714 rocq-prover CVE debrief

Who should care

Roles and deployment contexts that should assess exposure and prioritize verification include those responsible for managing and securing Rocq Prover deployments, particularly in environments where module usage and universe checking are critical.

Why it matters

The vulnerability in Rocq Prover requires verification of universe checking flag restoration, inventory checks, and monitoring for desynchronized universe checking state to prevent potential proof of False and maintain kernel state accuracy.

• Verification of universe checking flag restoration is required to prevent desynchronization and potential proof of False
• Inventory checks are necessary to identify systems and deployments using Rocq Prover
• Monitoring for desynchronized universe checking state and exception tracking are crucial for maintaining kernel state accuracy

Technical summary

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed, leading to desynchronization between the Test Universe Checking report and the kernel's acceptance of universe-inconsistent terms. This desynchronization can result in the application of Hurkens' paradox, potentially yielding a proof of False, from which any proposition follows. The issue arises because the universe graph maintains its own copy of the checking flag, which is not updated when a module that temporarily disabled the check is closed. Consequently, the Test Universe Checking report may indicate that the check is enabled, while the kernel continues to accept -

Defensive priority

Assess exposure and verify universe checking flag restoration in Rocq Prover modules; prioritize inventory checks and monitor for desynchronized universe checking state.

Recommended defensive actions

• Assess exposure to the vulnerability in Rocq Prover and verify universe checking flag restoration in modules
• Prioritize inventory checks for systems and deployments using Rocq Prover
• Monitor for desynchronized universe checking state and exception tracking
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Rocq Prover, where the universe graph's copy of the universe checking flag is not restored when a module that locally disabled the check is closed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.