Cyber ·
CVE-2026-72703: Rocq guard checker flaw lets a proof establish 0 = 1
Security advisory on the Rocq kernel guard checker, which accepts a non-terminating fixed point through unchecked cross calls and allows proving False without declared axioms.
According to the advisory published by Jonathan Brossard on October 25, 2026 on the oss-sec list, the guard checker of the Rocq kernel, a proof assistant, has a soundness flaw. It allows building a verified proof of False and, by extension, of any proposition, including 0 = 1, without axioms, tactics, plugins or unsafe flags. The report states that Print Assumptions shows the proof as closed in the global context, so this usual check does not detect the problem. The described cause is that the checker treats all parameters of a nested mutual fixed point as uniform, without examining the cross calls between them. The assigned identifier is CVE-2026-72703. To consult the original, search for the identifier or title in the oss-sec list for the fourth quarter of 2026, and check the fixed Rocq version named by the maintainers before trusting formal proofs already produced.