Cyber ·
CVE-2026-72714: Rocq kernel flaw lets a proof of False pass via universe checking state
Security advisory on a soundness flaw in the Rocq proof assistant kernel: after a module is closed, the universe checking state is not restored, allowing a proof of 0 = 1 with no apparent axioms.
The advisory, identified as CVE-2026-72714, describes a soundness flaw in the kernel of Rocq, a proof assistant used for formal verification. According to the text posted to the oss-sec list on October 25, 2026, the flaw allows building a verified proof of False and, by extension, of any proposition, including 0 = 1, without axioms, plugins or unsafe flags.
The reported cause is that the module system does not correctly restore the universe checking flag when a module locally disabled that check with the Local Unset Universe Checking option. According to the advisory, the Print Assumptions command reports the proof as closed in the global context, so checking axioms alone does not reveal the problem. The text received is truncated, so affected versions and fixes should be confirmed at the source.
The relevance is direct for anyone who uses formal proofs as assurance for software or specifications: a false proof can create unwarranted trust. Rota Nacional does not fix the Rocq kernel or certify proofs. The platform is an API compatible with OpenAI and Anthropic, with a personal data barrier, a usage dashboard and an encrypted audit trail, but these features do not replace verification by the proof assistant itself.
To verify, consult the original advisory through the official Rocq project channel and apply the fixed version it indicates. Rerun critical checks after updating, and do not treat a proof as trustworthy just because Print Assumptions shows no axioms.