Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Can anyone explain, why the numbering from this years CVE entries jumped from CVE-2017-15xxx to CVE-2017-1000xxx?
What about entries with the numbering sequence CVE-2017-16xxx, CVE-2017-17xxx, and so on?
Why are ~984 000 entries not numbered sequentially? Reading the official documentation gives me no idea about the answer to this question.
Probably because this missing block was assigned to a CVE Numbering Authorities (CNA): https://cve.mitre.org/cve/cna.html. As soon as a CNA have a vulnerability affecting one of their own products, then those missing CVE will be assigned.
In the CVE details page, you can check which CNA assigned a specific CVE, i.e: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8811 (Debian did it)
CVE IDs are assigned by CVE Numbering Authorities (CNA).
The CVE program uses a federated CNA structure.
When a CNA wants to assign a CVE ID, it must request a CVE ID block from its parent, which will mark this block as reserved.
All CVE-20XX-1000XXX vulnerabilities were allocated by the Distributed Weakness Filing Project, which is a root CNA, according to the CNA list.
As stated by MITRE, the DWF project were assigned a 7-digit block to differentiate their assignments from other CNA assignments, that's why there's such a large jump.
