# Correction: a CVE publication date was recorded as first public disclosure; the vendor advisory was three months older

- **Artifact ID:** CHQ-CORR-2026-037
- **Status:** IN FORCE
- **Public record:** https://record.cybersecurityhq.com/corrections/chq-corr-2026-037
- **Machine-record SHA-256:** `ad52f12c9dec7358f87e83f455cf2bd5a5b2af3c31711560f56cede9401a33d1`

## Complete structured record

```json
{
  "id": "CHQ-CORR-2026-037",
  "class": "CORRECTION",
  "subtype": "counting",
  "status": "IN FORCE",
  "authority": "DM ratified 2026-11-12",
  "effective": "2026-11-12",
  "published": "2026-11-12",
  "title": "Correction: a CVE publication date was recorded as first public disclosure; the vendor advisory was three months older",
  "what_was_wrong": "On SN-2026-11-10-01 (GPUStack), the record took the CVE publication date, 4 November 2026, as the first public disclosure and carried the entry as a pre-disclosure candidate on a five-day interval.",
  "what_is_true": "The vendor's advisory was published on 31 July 2026 and the fixed release on 18 June 2026. The advisory-to-listing interval is 101 days. The statement of exploitation is first attested on 5 November and cannot be placed before 31 July.",
  "what_changed": "The candidate status is withdrawn and the row is recorded as timing indeterminate. The interval is corrected. The internal briefing that carried the wrong interval was re-issued with a correction note.",
  "what_did_not_change": "No count, rating, Outlook or Watch. The row was never counted and nothing public carried the interval.",
  "control_analysis": "No chronology field distinguishes CVE publication from first public disclosure, and the one date the retained record supplied was used. A field change is queued for the criterion audit; until then the vendor advisory date is read before any interval is stated.",
  "found_by": "An external review; its dates were reproduced on the primary."
}
```