rocq-prover Rocq up to 9.1.x Guard Checker kernel/inductive.ml find_uniform_parameters input validation

Summaryinfo

A vulnerability was found in rocq-prover Rocq up to 9.1.x and classified as problematic. The affected element is the function find_uniform_parameters of the file kernel/inductive.ml of the component Guard Checker. The manipulation results in input validation. This vulnerability was named CVE-2026-72703. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in rocq-prover Rocq up to 9.1.x. It has been classified as problematic. Affected is the function find_uniform_parameters of the file kernel/inductive.ml of the component Guard Checker. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. CVE summarizes:

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. find_uniform_parameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes that every parameter is uniform. A parameter that grows through a cross-call from one body to another therefore keeps the subterm specification it inherited from the enclosing fixpoint, and a recursive call guarded by that specification is accepted although the argument is not structurally smaller. A non-terminating definition is admitted as structurally decreasing, which yields a term whose value equals its own successor and so a proof of False, from which any proposition follows. The proof requires no axioms, plugins or unsafe flags and Print Assumptions reports it as closed under the global context. Introduced in Coq 8.20 and fixed in Rocq 9.2.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-72703 since 08/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 9.2.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• rocq-prover

Name

• Rocq

Version

• 9.0
• 9.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion