Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built under Unset Universe Checking, so the resulting constant carries no trace of the unsafe operation. A module implementation can therefore prove False using a universe inconsistency, expose it through an inlined parameter, and have Print Assumptions report the dependent proof as closed under the global context. Because Print Assumptions is the in-process audit used to confirm that a development rests on no unexpected assumptions, a dependency built this way passes that audit while proving arbitrary propositions. The standalone checker coqchk does reject the resulting compiled file. The project records this in dev/doc/critical-bugs.md under non-fixed bugs and rates the risk as moderate when coqchk is not used.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rocq-prover | rocq | 8.11 – 9.2.0 | — | No fix listed | CNA |
- rocq Vendorrocq-prover Affected 8.11 – 9.2.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-37268
- 2026-10-03 Alias added: GHSA-5fm4-65fg-j439
References
More rocq-prover vulnerabilities
- TI-2026-50950 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close CVSS 4.0MEDIUM 6.8
- TI-2026-50943 Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument CVSS 4.0MEDIUM 6.8
- TI-2026-50942 Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport CVSS 4.0MEDIUM 6.8
- TI-2026-50941 Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls CVSS 4.0MEDIUM 6.8
Sources
- CVE-2020-37268 · CVE Program
- CVE-2020-37268 · NVD
- FIRST EPSS
- GHSA-5fm4-65fg-j439 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-37268 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences