MITRE Warns CVE Program Faces Disruption (Security Week) [LWN.net]

Security Week is one of several outlets reporting that the funding for the CVE program at MITRE disappears as of April 16.

Maintained by MITRE Corporation, a not-for-profit organization that operates federal R&D centers, the CVE program is funded through multiple channels, including the U.S. government, industry partnerships, and international organizations.
Earlier this month, in anticipation of the US government funding cuts, MITRE initiated layoffs that affected more than 400 employees in its Virginia office. The cuts were ordered after the Trump administration announced more than $28 million in canceled contracts for the company.

to post comments

Just don't look (up)

Posted Apr 15, 2025 21:42 UTC (Tue) by bojan (subscriber, #14302) [Link] (18 responses)

If you don't want to find out you are sick, don't test. If you don't want to find out you are vulnerable to computer security issues, don't publish announcements about them.

I think the official name for this strategy is "the ostrich technique."

Loonies are in charge folks. Brace.

Just don't look (up)

Posted Apr 16, 2025 8:48 UTC (Wed) by jhe (guest, #164815) [Link] (16 responses)

My impression was that projects publish their security issues on their own channels and MITRE/CVE numbers are not strictly required.

Just don't look (up)

Posted Apr 16, 2025 10:04 UTC (Wed) by tialaramex (subscriber, #21167) [Link] (15 responses)

The value of CVE numbers is like any vocabulary it lets different parties talk about the same thing without confusion.

If I ask whether this product is vulnerable to CVE-1234-98765 it's clear at least what I'm talking about, and while you might answer incorrectly at least the vocab isn't in the way. When I ask whether the new release solves bug #123456 there's every chance you think I meant internal bug tracker #123456 (about the UI glitch with copy-paste) not 3rd party library bug tracker #123456 (buffer overflow in a C parser). If ask if you've handled the "HD bug" you may think of the 2021 HD bug you fixed, not the 2025 HD bug you didn't read about yet, after all you did fix the HD bug.

You could build a distributed numbering system, the US government can't defund OIDs for example, every OID arc can just issue arcs underneath that arc, forever. But that's got its own problems, the central system is probably a good choice if it's properly funded.

Just don't look (up)

Posted Apr 16, 2025 11:24 UTC (Wed) by jhe (guest, #164815) [Link] (14 responses)

How would you, for example, refer to the https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT... incident?

Look how I referenced that thing precisely without needing an CVE number.

Just don't look (up)

Posted Apr 16, 2025 11:35 UTC (Wed) by intelfx (subscriber, #130118) [Link] (12 responses)

> How would you, for example, refer to the https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT... incident?

Not via a CVE, because 1) it's an incident, not a vulnerability, and 2) it was severe enough that it got its own Wikipedia article?

> Look how I referenced that thing precisely without needing an CVE number.

Yep, you referenced that thing via an entry in another global database (Wikipedia), which is structurally equivalent to CVE, but only worse. This does not prove that CVEs are not needed; quite the opposite.

Just don't look (up)

Posted Apr 16, 2025 11:49 UTC (Wed) by jhe (guest, #164815) [Link] (11 responses)

Duh, resolving a name globally has to have a central database either way. By specifying a URL i moved that to the domain name system, which i consider more distributed (and more independent from $thing) than MITRE.

Just don't look (up)

Posted Apr 16, 2025 12:21 UTC (Wed) by pizza (subscriber, #46) [Link] (8 responses)

> Duh, resolving a name globally has to have a central database either way. By specifying a URL i moved that to the domain name system, which i consider more distributed (and more independent from $thing) than MITRE.

Uh... what practical difference is there between http://mitre.org/SOMEID and http://wikipedia.org/SOMEOTHERID ?

Either way, they're just as distributed and independent from $thing (ie not at all)

The primary value of the CVE database is its centralized nature and its [mostly-]independence from upstream, which is generally incentivized to *not* report vulnerabilities at all, publicly OR privately. "Giving it back to the states" is an endorsement of the bad old days.

Just don't look (up)

Posted Apr 16, 2025 18:56 UTC (Wed) by jhe (guest, #164815) [Link] (6 responses)

The URL as the id. The whole thing. Not just the path segment.

Just don't look (up)

Posted Apr 16, 2025 20:16 UTC (Wed) by pizza (subscriber, #46) [Link] (5 responses)

> The URL as the id. The whole thing. Not just the path segment.

The URL of "CVE-2025-3112" is trivially derived from the identifier.

The "unique identifier" is the easy part. Making these unique IDs discoverable is much harder; and you still need independent and stable "ID repositories" for the cases where the vendor/upstream doesn't maintain this themselves (for reasons that range from "insufficient resources" to "will never intentionally acknowledge _any_ fault in their stuff")

Just don't look (up)

Posted Apr 17, 2025 17:23 UTC (Thu) by jhe (guest, #164815) [Link] (4 responses)

> Making these unique IDs discoverable is much harder; and you still need independent and stable "ID repositories"...

Yet somehow it took me 15 seconds to get that Wikipedia URL. So is that a real problem, still?

Just don't look (up)

Posted Apr 17, 2025 19:04 UTC (Thu) by pizza (subscriber, #46) [Link] (3 responses)

> Yet somehow it took me 15 seconds to get that Wikipedia URL. So is that a real problem, still?

First, you already knew what you were looking for, and second, you used a centralized search service [1] to find it.

So, as you just aptly demonstrated, it is a very real problem.

[1] either wikipedia itself, or a more general service (eg Google) that is not guaranteed to have indexed what you are looking for.

Just don't look (up)

Posted Apr 17, 2025 22:56 UTC (Thu) by jhe (guest, #164815) [Link] (2 responses)

A search service so centralized that you still have to guess which one i used.

Just don't look (up)

Posted Apr 17, 2025 22:59 UTC (Thu) by pizza (subscriber, #46) [Link] (1 responses)

> A search service so centralized that you still have to guess which one i used.

Once again, thank you for demonstrating the folly of your proposal.

Just don't look (up)

Posted Apr 18, 2025 13:02 UTC (Fri) by daroc (editor, #160859) [Link]

At this point, I don't think either of you is likely to be convinced, so it might be best to leave this thread here.

Just don't look (up)

Posted Apr 18, 2025 23:53 UTC (Fri) by ras (subscriber, #33059) [Link]

If the key utility of the CVE system is to have one unique ID for every problem so we can be sure we are all speaking the same language, then eliminating duplicates seems mandatory.

So how does a non-centralised system deal with duplicates? I don't know if/how MITRE deals with assigning multiple CVE's to the same thing, but it strikes me as a near impossible to solve without some central authority.

Just don't look (up)

Posted Apr 16, 2025 20:28 UTC (Wed) by intelfx (subscriber, #130118) [Link] (1 responses)

> By specifying a URL i moved that to the domain name system, which i consider more distributed (and more independent from $thing) than MITRE.

No, you moved that to the path component of the URL, which is looked up in the database on Wikipedia's servers.

Looking up https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT... is not at all structurally different from looking up https://www.cve.org/CVERecord?id=CVE-2025-29927.

"Moving it to the domain name system" would be something like https://CROWDSTRIKE-2024-OUTAGES.myvulnerabilitydatabase.verydistributed.org (which, according to my eyes, nobody is proposing).

Just don't look (up)

Posted Apr 16, 2025 20:56 UTC (Wed) by pizza (subscriber, #46) [Link]

> "Moving it to the domain name system" would be something like https://CROWDSTRIKE-2024-OUTAGES.myvulnerabilitydatabase.verydistributed.org (which, according to my eyes, nobody is proposing).

That "domain name system" thing would only work if you already know exactly what you're looking for.

If you don't, then it's completely non-discoverable, which leads us back to some sort of centralized index, and.....we've just recreated what we already have, only worse.

Just don't look (up)

Posted Apr 16, 2025 19:14 UTC (Wed) by tialaramex (subscriber, #21167) [Link]

You linked me to an encyclopedia article. The nature of those things is that today it's a link to the thing you presumably wanted to refer to, but maybe tomorrow it's redirected to a reference within an article about the company under a section named "incidents" and maybe in a few year's time it is dead, but with some searching I can find a footnote about how apparently in 2026 the Disney corporation purchased this outfit named "Crowdstrike" who were somehow related to whatever it was you cared about? Who knows. Wikipedia isn't space constrained, but in practice links to older material stop working.

The purpose of a CVE number is to identify a specific vulnerability. The fact that you can sometimes cobble together an alternative does not suggest this is redundant.

Just don't look (up)

Posted Apr 16, 2025 16:13 UTC (Wed) by amarao (guest, #87073) [Link]

Totally valid layer of defence. Also, trump may make itself prowd that in his first year number of published cves dropped 10x times.

It's hard to comment

Posted Apr 15, 2025 21:51 UTC (Tue) by dskoll (subscriber, #1630) [Link] (10 responses)

It's very hard to comment on this post without mentioning politics.

And I think that will be more and more the case going forward as incompetent and/or malicious politicians do their damage. 🙁

One Small Flame In A Raging Fire

Posted Apr 15, 2025 23:58 UTC (Tue) by linuxrocks123 (subscriber, #34648) [Link] (9 responses)

Obviously this is bad, but perhaps the computer security can use this as an opportunity to move to a different system for vulnerability numbering. It would be very simple to have an automated system where, if you can respond to an automated email sent to your email address, you get to issue numbers in that namespace. Maybe standard practice could be something like "security@projectdomain.org" is the name of a project's namespace.

As far as the broader political landscape, the only consolation I can offer is that this type of thing is typically self-correcting in our democracy. We've had "proud to be an idiot" populist movements before. William Jennings Bryan and his proposed "bimetalism" policy -- i.e., "let's have hyperinflation so my debts are worth less money in real terms" -- is a close parallel to the "let's wreck the economy with tariffs so I can be a coal miner again" aspect of our modern political moment. Now, Bryan didn't win, so that didn't actually happen, but, earlier in our history, Andrew Jackson did win, and Andrew Jackson f*ed up the economy pretty good by destroying our central bank and causing the Panic of 1837.

History says that once people get this out of their systems, then look around and see that their collective temper tantrum didn't help them, we go back to normal. Just got to tough it out until then.

Also, democracy is still the best form of government, because imagine if Trump were a king instead.

One Small Flame In A Raging Fire

Posted Apr 16, 2025 0:40 UTC (Wed) by butlerm (guest, #13312) [Link] (3 responses)

This is really off topic but it is hard to see how the free coinage of silver would lead to hyperinflation unless the private banks of the time issued bank notes with wild abandon.

Other than that I like your suggestions about automated issuance of a replacement for CVE numbers or maybe even CVE numbers themselves. What did those 300 employees at MITRE actually do anyway? Perhaps other things as well, but I am curious.

One Small Flame In A Raging Fire

Posted Apr 16, 2025 5:24 UTC (Wed) by jjs (guest, #10315) [Link]

Not specifics, but my reply to @bmur gives links to what MITRE does in broad terms - it's far more than the CVE program. Most likely the $28 million cut is for more than the CVE program - I give links in the @bmur response to news stories on the cuts, as did hmanning77.

One Small Flame In A Raging Fire

Posted Apr 16, 2025 19:19 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (1 responses)

This was at a time when the money supply was "controlled" by the scarcity of precious metals. You wanted to make money, you took some gold, melted it down, and made a coin stamped with "$1" or whatever. Given that environment, if you replaced gold coins with silver coins of the same weight and stamped them both with "$1", all of those farmers with $2000 mortgages on their land would suddenly find their debts extremely easy to pay off ... at the cost of hyperinflation wrecking the entire national economy.

The actual proposal wasn't quite as bad as saying 1 pound gold = 1 pound silver, but the proposed exchange rate between gold and silver intentionally and significantly overvalued silver. I forget exactly what the proposed exchange rate was because AP US History was ages ago for me.

One Small Flame In A Raging Fire

Posted Apr 17, 2025 9:42 UTC (Thu) by mbg (subscriber, #4940) [Link]

Wikipedia tells me that Bryan's plea for expansionary monetary policy came at the end of a period of deflation and economic depression, a pernicious state of affairs judged by many to be worse than inflation. There would have been winners and losers under bimetallism, but that's politics (or class struggle, perhaps).

One Small Flame In A Raging Fire

Posted Apr 16, 2025 6:39 UTC (Wed) by dsommers (subscriber, #55274) [Link] (4 responses)

> It would be very simple to have an automated system where, if you can respond to an automated email sent to your email address, you get to issue numbers in that namespace.

The whole CVE reservation and publishing process is already quite automated. It takes less than a few seconds to reserve a new ID. To publish the CVE record, you can use the vulnogram service or have some tooling creating a JSON file (or create it by hand) and then publish it via some CLI tools.

But someone need to maintain and cover the cost of these services and its infrastructure

One Small Flame In A Raging Fire

Posted Apr 16, 2025 19:01 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (3 responses)

I could host an email submission queue and low-traffic static webpages as a side service on the VPS I pay $29 a year for. Either they're not as automated as what I am proposing, or they are (were) wasting a lot of money.

All of the drama regarding CVE assignment over the years has been really disappointing to me. Counting up is not hard.

One Small Flame In A Raging Fire

Posted Apr 16, 2025 20:14 UTC (Wed) by dsommers (subscriber, #55274) [Link] (2 responses)

I would recommend you to dig into all the aspects of what MITRE does before commenting so strongly. The information isn't that hard to find ... https://www.mitre.org/

Maintaining the CVE database is just one of many other bigger tasks in the MITRE picture. In addition, you have a very lacking understanding of what the CVE programme functions ... Here's a reasonable starting point: https://www.cve.org/About/Overview

One Small Flame In A Raging Fire

Posted Apr 16, 2025 21:48 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (1 responses)

Of course they do things other than count up. That was never in dispute. I'm not saying anything good or bad about MITRE. What I am saying is that if their funding for providing an atomically incrementing namespace that people use to name security problems goes away, then we can replace that at an infinitesimal cost. Providing that namespace ourselves would solve the problem in this article.

But it looks like MITRE got their money back, so yay, they can keep counting up for us now.

One Small Flame In A Raging Fire

Posted Apr 17, 2025 8:42 UTC (Thu) by farnz (subscriber, #17727) [Link]

It's a harder problem than you might think; you also need to verify that the description of the bug is legitimate, and offer the descriptions to the public. One of the goals of CVE is that a given CVE number refers to exactly one vulnerability, and thus you need to remove duplicates, delete non-vulnerability "vulnerabilities" that get reported, and split CVEs into multiple CVEs when it becomes clear that it's actually multiple vulnerabilities.

As LWN.net admins can tell you, simply the publishing the descriptions part without the moderation to make sure it's useful for the intended purpose is hard. Adding moderation to make sure that CVE numbers are useful is another grade of difficulty.

Alternative funding

Posted Apr 16, 2025 2:56 UTC (Wed) by pabs (subscriber, #43278) [Link]

I wonder if the German Sovereign Tech Agency is thinking about funding or taking over the CVE program.

400 In Anticipation?

Posted Apr 16, 2025 3:50 UTC (Wed) by bmur (guest, #52954) [Link] (4 responses)

If MITRE can layoff 400 people in anticipation of federal grant cuts, it sounds like they certainly outgrew their mission.

It will be interesting to see if and when funding cuts actually do come their way, if they take the malicious compliance path and axe the CVE program or go after the fluff like their DEI management staff. The route they choose will say a lot about their credibility moving forward.

400 In Anticipation?

Posted Apr 16, 2025 5:00 UTC (Wed) by hmanning77 (subscriber, #160992) [Link]

> Earlier this month, in anticipation of the US government funding cuts, MITRE initiated layoffs that affected more than 400 employees in its Virginia office. The cuts were ordered after the Trump administration announced more than $28 million in canceled contracts for the company.

It could certainly be clearer, but the way I read this is that layoffs happened in response to messaging from the government. Looking for specific details of the contracts brought up this article from Virginia Business, which is more specific, and puts all the cancellations before this month's layoffs.

> The 11 terminated contracts are from the National Institutes of Health, the IRS, the Treasury Department’s Bureau of the Fiscal Service, the Social Security Administration, the Centers for Disease Control and Prevention, the Federal Emergency Management Agency (FEMA) and the Department of Homeland Security’s procurement operations office, according to G2X. All of the contracts were canceled in late January through March 24.

Source: https://virginiabusiness.com/nova-govcon-firm-mitre-to-la...

I didn't see any mention of DEI in there. Has MITRE been known to do work in that space?

MITRE mission & federal appropriations process

Posted Apr 16, 2025 5:17 UTC (Wed) by jjs (guest, #10315) [Link]

Check out https://en.wikipedia.org/wiki/Mitre_Corporation#Organization and https://www.mitre.org/who-we-are - MITRE basically only works for the US Government, running FFRDCs (Federally Funded Research & Development Centers). And they run many projects, of which the CVE program is just one.

Nor do they have a choice on what to cut. Congress (who has the power of the purse) does NOT just give MITRE $xyz funding for MITRE to do what they want. Money is allocated in specific amounts for specific projects, as part of the yearly appropriations (note this is true of almost all the discretionary budget, no matter the department, see https://www.congress.gov/crs_external_products/R/PDF/R471...). From that report

"Appropriations acts provide funding in definite dollar amounts for specific purposes over limited
periods of time. Once appropriations legislation has been enacted, the specified amounts,
purposes, and time periods included impose legal constraints on the subsequent use of
appropriated funds. Generally speaking, the executive branch is prohibited from (1) spending
more than is appropriated, (2) spending less than is appropriated, and (3) spending for purposes
other than those specified. "

If the CVE project money is cut, MITRE has to cut that program.

Going by https://www.nextgov.com/cybersecurity/2025/04/mitre-backe... https://www.pcmag.com/news/nonprofit-that-tracks-software... and https://virginiabusiness.com/nova-govcon-firm-mitre-to-la... that's exactly what's happening. The funding for the CVE program (as well as others to the amount of $28 million) is expiring, and DHS has not renewed the funding, so MITRE has to stop work on it. What priority it has doesn't matter. The funding is going away for that program, so they have to cut it, regardless of the priority of the program, or the funding for other projects. There is no "outgrew their mission" - the funding was cut.

400 In Anticipation?

Posted Apr 16, 2025 20:18 UTC (Wed) by fest3er (guest, #60379) [Link] (1 responses)

MIT Research and Engineering? Before they were spun off and grew into a behemoth on taxpayers backs? Like most defense contractors?

I can see it taking $35B to *design* a warplane, but not $35B to build *each one*. Similarly, I could see it taking $10,000 per annum to host a CVE database system, $100,000 if there's a dedicated employee or manager. But not much more than that. $1M or more is right out. (Insert the Book Of Armaments quote here; sorry.)

400 In Anticipation?

Posted Apr 18, 2025 16:25 UTC (Fri) by vonbrand (guest, #4458) [Link]

Need people to weed out non-vulnerabilities, check for dozens reporting the same problem in often wildly different ways, make up a coherent, clean description out of the reports, fast. No, not one web-site manager (part time) and a fix-problems-on-call guy, and a reputable webhosting place only.

Foundation

Posted Apr 16, 2025 9:39 UTC (Wed) by pabs (subscriber, #43278) [Link]

Seems like a CVE Foundation is being formed:

https://www.thecvefoundation.org/

Alternative

Posted Apr 16, 2025 10:14 UTC (Wed) by pabs (subscriber, #43278) [Link] (2 responses)

An alternative was launched:

https://gcve.eu/

Alternative

Posted Apr 16, 2025 13:10 UTC (Wed) by pabs (subscriber, #43278) [Link]

https://euvd.enisa.europa.eu/

Alternative

Posted Apr 18, 2025 16:29 UTC (Fri) by vonbrand (guest, #4458) [Link]

Obligatory XKCD 927: How standards proliferate. The whole point was there was one place to go to.

Funding restored

Posted Apr 16, 2025 13:11 UTC (Wed) by pabs (subscriber, #43278) [Link]

https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/c...

> Update Apr. 16 at 08:20 EST: In an eleventh hour turnaround, the U.S. Cybersecurity and Infrastructure Security Agency said it had extended the contract with MITRE.