Cyber ·
CVE-2020-37268: Rocq/Coq Print Assumptions can omit unsafe universe checks via Parameter Inline
A soundness flaw in the Rocq/Coq module system can let Print Assumptions report a proof of False as closed, with no visible axioms or unsafe flags. The advisory title states that no fix has existed since 2020.
This Radar item is a security advisory published on 26 October 2026 about CVE-2020-37268, which affects the module system of Rocq, formerly known as Coq, a proof assistant used for formal verification. According to the text, when a module type declares Parameter Inline and a functor application embeds the parameter body, the metadata recording that the original definition was produced with Unset Universe Checking is discarded. As a result, the Print Assumptions command can report a proof of False as closed in the global context, with no visible axioms or unsafe flags. The title states that the problem has had no fix since 2020. It matters for teams that rely on formal proofs to certify software or research, because a clean-looking audit may not be trustworthy. Rota Nacional does not check Rocq/Coq proofs and does not solve this engineering problem. To verify the advisory, consult the original version cited in the bookmark, on the oss-sec mailing list, and look up identifier CVE-2020-37268 in the official CVE database. Also review the Rocq project release notes. The Radar text is a machine translation, so prefer the original source when in doubt.