Quick answers
- Is CVE-2026-72703 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72703 being exploited in the wild.
- How severe is CVE-2026-72703?
- Medium severity, with a CVSS score of 6.3, published 24 August 2026.
- Which products and versions are affected?
- Rocq Prover 8.20 through 9.1.x.
- Is there a fix for CVE-2026-72703?
- A patch was published on 2026: Fixed in Rocq 9.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-72703 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-72703?
- Check whether you run Rocq Prover at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a logical inconsistency in the guard checker mechanism (kernel/inductive.ml) that validates recursive function definitions. The find_uniform_parameters function inspects only self-recursive calls within nested mutual fixpoints and incorrectly marks parameters as uniform when no body calls itself, failing to examine cross-calls between different fixpoint bodies. When a parameter grows through such cross-calls, it retains an inherited subterm specification that allows recursive calls to be accepted even though their arguments are not structurally smaller. This permits non-terminating definitions to be admitted as structurally decreasing, enabling construction of a term whose value equals its own successor, yielding a proof of False without requiring axioms or unsafe flags. The vulnerability was introduced in Coq 8.20 and is patched in Rocq 9.2.0.
Affected products
- Rocq Rocq Prover 8.20 through 9.1.x
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in Rocq 9.2.0