I wanted to ask how to deal with a new remote code execution vulnerability that has the same origin as an already found Denial of Service vulnerability? Can I apply for a new CVE ID for this? This is because the original vulnerability focuses on a Denial of Service and does not contain any remote code execution instructions. Does this count as a separate exploit even though they exploit the same parameter? Or more generally, can I apply for 'similar' but different CVEs?

1 Answer 1


It depends. If it's the same vulnerability, the old CVE could be updated with the new rating. On the other hand, even having "the same origin" could be a different vulnerability. There are lots of cases of this (in fact, you often even see very similar CVE descriptions explicitely stating "this is a vulnerability different than CVE-XYZ").

Not knowing the specific details, there's little more I can opine. I see no harm contacting the vendor and MITRE (or whatever is the relevant CNA) explaining the vulnerability you found and how it is very similar to CVE-1234.

I think both outcomes are possible: allocating a new CVE or treating it as another instance of the existing CVE. I think it may be more common to give it a new CVE, but different vendors have different position, too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .