# CVE-2026-72714: Rocq Prover kernel soundness bug in universe checking state desynchronization

Source: https://junglewise.ai/threats/cve-2026-72714-rocq-prover-kernel-soundness-bug-in-universe-checking-state  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72714 · Severity: medium · CVSS 6.3 · Published 2026-08-24

Rocq Prover, an interactive theorem proving system used for formal verification of software and mathematics, has a critical flaw in how it manages universe checking rules within modules. When a module locally disables universe checking, the setting is not properly restored when the module closes, causing the kernel to accept mathematically unsound proofs that violate fundamental logical constraints. This allows attackers to prove false statements (like "0 = 1") without using any unsafe features, potentially invalidating all formally verified software that relied on proofs created in affected environments.

Technologies: [Rocq Prover](https://junglewise.ai/threats/technologies/rocq-prover). Vendors: [Rocq](https://junglewise.ai/threats/vendors/rocq).

## Quick answers

**Is CVE-2026-72714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72714 being exploited in the wild.

**How severe is CVE-2026-72714?** Medium severity, with a CVSS score of 6.3, published 24 August 2026.

**Which products and versions are affected?** Rocq Prover ≤ 9.2.0 and Coq 8.x (all versions with Hurkels in stdlib).

**Is there a fix for CVE-2026-72714?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72714 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-72714?** Check whether you run Rocq Prover at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a state desynchronization bug (CWE-488) in the module system of Rocq Prover. The universe graph (ugraph) maintains its own copy of the universe checking flag independently of the global state. When "Local Unset Universe Checking" is used inside a module, both the global state and ugraph flag are modified. However, when the module closes, only the global state is restored from the saved module state; the ugraph's copy remains disabled. This creates a desync: Test Universe Checking reports the flag as enabled (reading global state) while the kernel continues accepting universe-inconsistent terms (using the stale ugraph flag). An attacker can exploit this by constraining two universes to be ordered, then disabling checks in a module, allowing them to treat universes as equal after module closure. This enables Hurkels' paradox, which derives a proof of False from the type-level contradiction. The exploit requires no axioms, plugins, or unsafe features, and the proof appears sound under Print Assumptions. No patch is currently available.

## Affected products

- Rocq Rocq Prover ≤ 9.2.0 and Coq 8.x (all versions with Hurkels in stdlib)

## Timeline

- 2026-08-24: disclosed
- 2026-08-16: other: Issue reported as open with no fix available

## References

- [https://github.com/endrazine/rocq-cve-poc-22287](https://github.com/endrazine/rocq-cve-poc-22287)
- [https://github.com/rocq-prover/rocq](https://github.com/rocq-prover/rocq)

## Related threats

- [Rocq Prover guard checker higher-order fixpoint bypass](https://junglewise.ai/threats/cve-2026-72705-rocq-prover-guard-checker-higher-order-fixpoint-bypass)
- [Rocq Prover guard checker fixpoint parameter handling flaw](https://junglewise.ai/threats/cve-2026-72703-rocq-prover-guard-checker-fixpoint-parameter-handling-flaw)
- [Rocq Print Assumptions logic error in universe checking](https://junglewise.ai/threats/cve-2020-37268-rocq-print-assumptions-logic-error-in-universe-checking)