Provenance Record

Clear, well-structured News piece (729 words, within the 400-1200 range) that reports a project's own CVE page accurately, labels its own counts as the Herald's, and states plainly what is not known.

Allowlist: kafka.apache.org was not listed (only news.apache.org and fluss.apache.org). Authenticity independently verified: the apache/kafka GitHub README.md links https://kafka.apache.org as the project site, and SECURITY.md directs reporters to [email protected] and points readers to kafka.apache.org/cve-list as the official CVE list; the live CVE page returns HTTP 200, server Apache. Added kafka.apache.org to config/source_allowlist.txt with justification comment (same tier as fluss.apache.org). All four snapshots (source-0..3.html.gz) read from disk and then re-fetched live; the live CVE page has the same 36 'Issue announced' fields and 12 '28 Oct 2026' dates as the snapshot; suspicious_patterns null for all four. source-0 (CVE list): all 12 entries dated '28 Oct 2026' (the next, CVE-2026-41115, is '2 Jun 2026'). Per-entry fixed versions recounted from raw text: nine list '4.2.2, 4.3.2, 4.4.0' (CVE-2026-114349, 112375, 111551, 111115, 111108, 116593, 115644, 111496, 83525); two list '4.2.2, 4.3.1, 4.4.0' (CVE-2026-110985, 111073); CVE-2026-110952 lists only '4.4.0' with 'Versions affected 3.1.0 through 4.3.2'. All matches the article. CVE-2026-110985 title and body verified verbatim (default validator falls back to ClientJwtValidator, which 'does not verify the JWT signature, algorithm, or issuer', broker starts 'with no warning or error', 'residual of CVE-2026-33557', affected 4.1.0-4.1.2, 4.2.0-4.2.1, 4.3.0, mitigation set sasl.oauthbearer.jwks.endpoint.url, ConfigException from 4.2.2/4.3.1/4.4.0). CVE-2026-110952 issuer/audience details, opt-out flags and multi-issuer JWKS caveat verified. CVE-2026-112375 (file/env read via config validation before authorization; 'Clusters with no authorizer configured are not affected in practice') verified. Connect entries CVE-2026-116593 (validate endpoint) and CVE-2026-115644 (/admin/loggers unauthenticated, admin.listeners workaround) verified. CVE-2026-114349 (~90-byte batch, ~2 GiB, 'Upgrading alone is not sufficient', max.decompressed.message.bytes) verified verbatim; CVE-2026-111115, 111108, 111551, 111073, 111496 (Long.MAX_VALUE StreamThread hang), 83525 (CLUSTER_ACTION, KRaft controller) verified. The 'five entries involve oversized allocations' count (114349, 111551, 111115, 111108, 111073) is correct and labelled as the Herald's. No severity or CVSS labels exist on the page (grep for severity/CVSS/critical/important/moderate: none) and the article states none. source-1 (downloads): 4.4.0 'Released October 22, 2026', 4.3.2 'Released October 23, 2026', 4.2.2 'Released September 29, 2026'; 4.3.2 text names KAFKA-20732 and KAFKA-20979 and dependency CVE updates (jackson-databind, lz4-java, log4j, jetty). source-2 (4.4.0 announcement): dated October 22, 2026; '25 KIPs and 963 commits since 4.3.0'; no mention of these CVEs. source-3 (4.3.2 announcement): dated October 23, 2026; the two tiered-storage data-loss fixes, Streams fixes and dependency CVE updates as described; does not name the 12 entries. No causal link between the releases and the CVEs is asserted beyond what the pages show. All body URLs are in article.sources and vice versa. Category is News, not Analysis, so the Analysis requirements do not apply; article states it is first-party only.

Every CVE id, description, version list, number, date and the one direct quote verified against raw page text; no errors found. Minor note: the CVE-2026-110985 entry text says 'ClientJwtValidator' and the article's paraphrase is faithful.

Accurate, carefully hedged first-party report; all 12 entries and counts verified against the raw CVE list. Approved with the kafka.apache.org allowlist addition. Featured candidacy: 2 - an unauthenticated JWT-forgery-class OAUTHBEARER flaw and several pre-auth broker DoS issues in a very widely deployed streaming platform, though first-party only