Provenance Record

Clear News structure (Overview, four shared fixes, extra 29.1.2 fix, other changes, What We Don't Know). 710 words (range 400-1200). Neutral, technical, no AI self-reference. Every body URL is in article.sources and vice versa (orphan-link diff empty).

All 8 sources are first-party (Erlang/OTP project, github.com/erlang/otp); github.com is on config/source_allowlist.txt. Snapshots source-0..2 (release READMEs) are byte-identical (sha256 match) to the live release assets fetched via the GitHub API; snapshots 3..7 (advisory HTML pages, status 200) were cross-checked against the live advisories via the GitHub security-advisories API. manifest suspicious_patterns: none for any source. NVD is linked only in README footnotes; no article claim relies on NVD. Release READMEs: OTP 29.1.2, 28.5.0.8, 27.3.4.19 each dated 2026-10-14 (releases published 2026-10-14T15:30:35Z, 15:30:36Z and 15:38:42Z via API); each lists CVE-2026-105236, CVE-2026-42789, CVE-2026-48856, CVE-2026-94200; only 29.1.2 lists CVE-2026-96596 (stdlib-8.1.1). Package versions confirmed: ssl 11.7.8/11.6.0.7/11.2.12.14, public_key 1.21.8/1.20.3.6/1.17.1.7, inets 9.8.1/9.6.2.4/9.3.2.8. GHSA-m5mh-q53w-67jq = CVE-2026-94200, ssl, high, CVSS 4.0 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H), CWE-1288, published 2026-10-14, patched OTP 29.1.2, 28.5.0.8, 27.3.4.19; the article's description, workaround ({session_tickets, auto}) and ssl versions match. GHSA-2g23-cgjh-34gq = CVE-2026-105236, ssl, medium, CVSS 4.0 6.3, CWE-295, published 2026-10-14, patched in all three; prerequisites, 'TLS 1.3 is not affected', three workarounds match; the reuse_sessions/verify_peer note is in the 29.1.2 README (also in 28.x/27.x). Note the advisory's impact text also says deployments sharing one certificate are not affected while the description/prerequisites describe same cert with distinct client CAs; the article reproduces the prerequisites list accurately. GHSA-c99q-jmpx-v8qq = CVE-2026-42789, public_key, high, CVSS 4.0 7.0, CWE-295/296, published 2026-05-27, patched in all three; advisory says 'mostly fixed' in 29.0.1, 28.5.0.1, 27.3.4.12, 26.2.5.21 and 'gap for Legacy cert of version 1 or 2 was closed by amended fix'; README quote 'This closes the version-1 path left uncovered by the earlier CVE-2026-42789 fix.' verbatim in all three READMEs. GHSA-m75x-4vwg-ggjh = CVE-2026-48856, inets/httpc, high, CVSS 4.0 7.1, CWE-601, published 2026-06-10, patched in all three; advisory states partial fix in 29.0.2, 28.5.0.2, 27.3.4.13 and 'This gap is now closed'; autoredirect default true confirmed. GHSA-phm5-m6cj-5382 = CVE-2026-96596, stdlib erl_tar, medium, CVSS 4.0 5.9, CWE-835, published 2026-10-14, vulnerable >= 29.0, patched 29.1.2 only (stdlib 8.1.1); 2048-byte archive/one scheduler, hex_erl_tar/mix_hex_erl_tar/r3_hex_erl_tar copies 'affected on any OTP version', OTP 28 not affected but apps via affected hex_core/Hex/rebar3 are, workaround {chunks,N}+{max_size,N}, memory option unaffected - all match. The 'partial earlier fix' claims for CVE-2026-42789 and CVE-2026-48856 are stated by the advisories and READMEs, not inferred. No CVSS score is stated that the advisory does not give. Title groupings accurate (two ssl/TLS CVEs, one public_key X.509 CVE, one inets/httpc CVE). SSH max_channels incompatibility and 'thousands of clauses' compile fix verified in the 29.1.2 README; 28.x/27.x READMEs also carry a potential-incompatibilities section. Credits: advisories name reporters/developers (e.g., Theori researchers, Jonatan Männchen, John Downey, David Korczynski, Eric Meadows-Jönsson); the article names none, an omission rather than an error.

Every number, date, version, CVE/GHSA id, severity label and CVSS 4.0 score traces to the advisories or READMEs. Direct quotes ('mostly fixed', 'is now closed', README sentence) are verbatim. Minor imprecision, not requiring correction: 'closed gaps left by earlier partial fixes' is accurately sourced. 'Published May 27' / 'June 10' are the advisories' original publication dates (the latter two were updated October 14-15).

Accurate, well-sourced first-party security release coverage with no errors found; ready for publication as-is. Featured candidacy: 1 - accurate multi-branch security release coverage for a defined Erlang/BEAM developer audience