Theoretically: Contact a CNA or Mailing List
As others have stated, you would contact a CNA. If you can't find one in the list of software vendors, you would contact MITRE directly.
You could also post it to a mailing list instead of contacting a CNA. MITRE mentions bugtraq - where you would just publish your vulnerability (not a request for a CVE), and ideally get a CVE by MITRE - , but you could also use oss-security, which is mainly used for CVE requests (you can see the rate of assignments from cve-assign @ MITRE, so you can consider if it's actually worth it).
If you request CVEs via multiple methods, you should mention any previous requests - successful or not - to avoid duplicate assignments.
These possibilities are also described by MITRE on their Request a CVE info page:
Contact one of the officially recognized CVE Numbering Authorities
(CNAs) [... o]r, contact an emergency response team such as CERT/CC,
etc., post the information to mailing lists such as Bugtraq, or
provide the information to a vulnerability analysis team [...] If you
are unable to obtain a CVE Identifier number via the main methods
above, you may request a CVE Identifier number directly from the CVE
Practically: MITRE is having trouble assigning CVEs
The thing is that MITRE is having trouble actually assigning CVEs because of a rise in discovered vulnerabilities, so it requires a bit of luck to actually get one from them.
There have been complains for a while, and MITRE has a note on their website calling it a "delay":
The recent explosion of Internet-enabled devices—known as the Internet
of Things—as well as the propagation of software-based functionality
in systems has led to a huge increase in the number of CVE requests we
have been receiving on a daily basis. We did not anticipate this rate
of growth, and, as a result, were not as prepared for the latest surge
in requests over the past 12 months as we had hoped. The result has
been some of the delay in CVE assignments that the software security
community has recently witnessed. We recognize the inconvenience that
has resulted, and are working hard to come up with a solution.
While MITRE only talks about a delay, others report that they are not receiving responses at all, see here, here or here (which is also my experience and what the activity at mailing lists such as oss-security indicate).