I am writing an application which uses CVE identifiers to cross-reference vulnerabilities. I would like to make it compatible with future CVE identifiers.
If it happens that there are more than 9999 CVE identifiers in a year, what number will follow after 9999?
For example what will be the identifier after CVE-2012-9999? Will it be CVE-2012-10000 or something else?
The highest CVE number in 2011 seems to be CVE-2011-5096 thus it is just a matter of time when this becomes a real issue.
I have tried to find this out at https://cve.mitre.org/ but I can only find the following:
CVE entries and candidates are of the form CVE-YYYY-XXXX where YYYY is a year, and XXXX is a number.
That does not really help.