Correction: a CVE publication date was recorded as first public disclosure; the vendor advisory was three months older

Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.

id

CHQ-CORR-2026-037

class

CORRECTION

subtype

counting

status

IN FORCE

authority

DM ratified 2026-11-12

effective

2026-11-12

published

2026-11-12

title

Correction: a CVE publication date was recorded as first public disclosure; the vendor advisory was three months older

what was wrong

On SN-2026-11-10-01 (GPUStack), the record took the CVE publication date, 4 November 2026, as the first public disclosure and carried the entry as a pre-disclosure candidate on a five-day interval.

what is true

The vendor's advisory was published on 31 July 2026 and the fixed release on 18 June 2026. The advisory-to-listing interval is 101 days. The statement of exploitation is first attested on 5 November and cannot be placed before 31 July.

what changed

The candidate status is withdrawn and the row is recorded as timing indeterminate. The interval is corrected. The internal briefing that carried the wrong interval was re-issued with a correction note.

what did not change

No count, rating, Outlook or Watch. The row was never counted and nothing public carried the interval.

control analysis

No chronology field distinguishes CVE publication from first public disclosure, and the one date the retained record supplied was used. A field change is queued for the criterion audit; until then the vendor advisory date is read before any interval is stated.

found by

An external review; its dates were reproduced on the primary.