# CVE-2020-37268: Rocq Print Assumptions logic error in universe checking

Source: https://junglewise.ai/threats/cve-2020-37268-rocq-print-assumptions-logic-error-in-universe-checking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-37268 · Severity: medium · CVSS 6.3 · Published 2026-08-24

Rocq is an interactive theorem prover used to develop and verify formal mathematical proofs. A flaw in its Print Assumptions audit tool allows proofs that rely on unsafe universe-checking assumptions to be incorrectly reported as valid, potentially allowing false mathematical claims to pass internal verification checks. While the standalone coqchk validator catches this, teams relying only on Print Assumptions could deploy flawed proofs into production.

Technologies: [Rocq Prover](https://junglewise.ai/threats/technologies/rocq-prover). Vendors: [Rocq](https://junglewise.ai/threats/vendors/rocq).

## Quick answers

**Is CVE-2020-37268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37268 being exploited in the wild.

**How severe is CVE-2020-37268?** Medium severity, with a CVSS score of 6.3, published 24 August 2026.

**Which products and versions are affected?** Rocq Rocq Prover.

**Is there a fix for CVE-2020-37268?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-37268 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2020-37268?** Check whether you run Rocq Prover. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a logic error in how Rocq's Print Assumptions function reports proof dependencies when universe checking is disabled. When a definition is created with universe checking disabled and then inlined through a functor parameter, the inlining operation drops the record that the term was built unsafely, causing Print Assumptions to report the proof as closed under the global context even though it depends on an unsafe assumption. An attacker or careless developer can craft a module that proves False using a universe inconsistency, expose it through an inlined parameter, and have the dependency audit pass. The standalone coqchk checker correctly rejects such files, but projects relying solely on in-process Print Assumptions auditing can be affected. No patch availability is indicated in the advisory.

## Affected products

- Rocq Rocq Prover

## Timeline

- 2026-08-24: disclosed

## References

- [https://github.com/endrazine/rocq-cve-poc-12155](https://github.com/endrazine/rocq-cve-poc-12155)
- [https://github.com/rocq-prover/rocq](https://github.com/rocq-prover/rocq)

## Related threats

- [Rocq Prover kernel soundness bug in universe checking state desynchronization](https://junglewise.ai/threats/cve-2026-72714-rocq-prover-kernel-soundness-bug-in-universe-checking-state)
- [Rocq Prover guard checker higher-order fixpoint bypass](https://junglewise.ai/threats/cve-2026-72705-rocq-prover-guard-checker-higher-order-fixpoint-bypass)
- [Rocq Prover guard checker fixpoint parameter handling flaw](https://junglewise.ai/threats/cve-2026-72703-rocq-prover-guard-checker-fixpoint-parameter-handling-flaw)