CVE-2020-37268
Received Received - Intake

Universe Inconsistency in Coq Print Assumptions via Parameter Inline

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built under Unset Universe Checking, so the resulting constant carries no trace of the unsafe operation. A module implementation can therefore prove False using a universe inconsistency, expose it through an inlined parameter, and have Print Assumptions report the dependent proof as closed under the global context. Because Print Assumptions is the in-process audit used to confirm that a development rests on no unexpected assumptions, a dependency built this way passes that audit while proving arbitrary propositions. The standalone checker coqchk does reject the resulting compiled file. The project records this in dev/doc/critical-bugs.md under non-fixed bugs and rates the risk as moderate when coqchk is not used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-25
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2020-37268
EUVD
EUVD-2020-31263

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
inria coq to 9.2.0 (inc)
inria rocq to 9.2.0 (inc)
inria coq 8.11.1
inria rocq 8.11.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-778 When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Coq/Rocq Prover's Print Assumptions feature failing to report when a definition was created with universe checking disabled. When a definition is passed through Parameter Inline in a module type and inlined via a functor, the unsafe operation's record is dropped. This allows a module to prove False using universe inconsistency, expose it through an inlined parameter, and have Print Assumptions incorrectly validate the proof as safe under the global context.

Detection Guidance

This vulnerability is specific to the Coq/Rocq Prover theorem prover and cannot be detected via standard network or system commands. It requires inspecting Coq module definitions and assumptions using Coq's own tools like 'Print Assumptions' and 'coqchk'.

Impact Analysis

An attacker could exploit this to create a proof of False in a Coq/Rocq development, bypassing safety checks. This could lead to incorrect proofs being accepted as valid, potentially compromising the integrity of formal verifications. The standalone checker coqchk rejects affected files, but without it, the vulnerability allows arbitrary propositions to pass audits.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it pertains to a proof assistant tool (Coq/Rocq Prover) used for formal verification. The issue involves incorrect reporting of assumptions in proofs, which could lead to invalid proofs being accepted. However, there is no evidence in the provided context that this vulnerability affects data handling, privacy, or security controls required by GDPR or HIPAA.

Mitigation Strategies

Upgrade to a patched version of Coq/Rocq Prover beyond 9.2.0. If upgrading is not possible, manually verify assumptions using 'coqchk' instead of relying on 'Print Assumptions'. Avoid using untrusted Coq code or .vo files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-37268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart