The World Nearly Lost Its Only Shared Catalog of Software Flaws

For over twenty-five years, almost every security product on the planet has spoken a single language: the CVE identifier, a plain string like CVE-2021-44228 that lets a scanner in Tokyo, a patch bulletin in Berlin, and an insurance underwriter in New York agree they are discussing the same defect. In April 2025, that shared vocabulary came within hours of going silent when the United States government contract funding it was allowed to lapse, and the rescue arrived only at the eleventh hour. The episode exposed how a vendor’s fate during a public flaw disclosure hinges on whether its messaging was prepared like this in advance, by specialists who understand both the technology and the audience, or improvised at midnight after the identifier hits the news. What follows is the documented account of how the vulnerability-tracking system drifted into crisis, what actually broke, and which replacement structures are now being built around it.

One Numbering System Underneath Everything

The Common Vulnerabilities and Exposures program began in 1999 as an academic proposal to end the chaos of every vendor naming the same bug differently. It succeeded so completely that the entire vulnerability-management economy consolidated on top of it. MITRE, the nonprofit that operates the program under a Department of Homeland Security contract, coordinates hundreds of numbering authorities — software vendors, national CERTs, bug bounty platforms — that assign identifiers, while the National Vulnerability Database run by NIST adds the analysis layer: severity scores, affected-product tags, and weakness classifications that scanners and compliance tools consume automatically.

The volume tells the story of dependence. The program documented more than 40,000 new vulnerabilities in 2024 alone, with submissions jumping roughly 32 percent year over year. National vulnerability databases in other countries, thousands of regional CERTs, and effectively every commercial scanner repackage this same feed. There is no meaningful redundancy: when researchers describe CVE as a single point of failure for global cyber defense, they are being literal, not rhetorical.

Spring 2024, When the Analysis Layer Stalled

The first crack appeared not in the identifier pipeline but in the enrichment behind it. In early 2024, NIST sharply cut back the analysis work feeding the National Vulnerability Database, and within weeks the flow of severity scores and product mappings slowed to a trickle — by March 2025, monthly output had fallen to fewer than 300 analyzed entries against thousands of new submissions. The backlog swelled past 25,000 unprocessed records, nearly ten times the previous historical peak from 2017, and NIST eventually marked tens of thousands of older entries as deferred, meaning they will likely never receive full analysis at all.

The practical consequence lands on defenders, because a bare identifier without enrichment answers none of the questions a security team actually asks. Which products are affected? How severe is it? Is it being exploited? During the backlog’s worst stretch, organizations discovered that their expensive scanning tools were only as current as a database that was quietly weeks or months behind, and the gap between a flaw’s disclosure and its appearance in automated tooling became an open window that attackers demonstrably use.

April 16, 2025, and the Eleven-Month Reprieve

Then the identifier pipeline itself nearly stopped. On April 15, 2025, a leaked letter from MITRE vice president Yosry Barsoum confirmed that the contract to operate CVE would expire the following day, warning of deterioration across national databases, tool vendors, and incident response worldwide. MITRE had already laid off over 400 staff the month before. Only hours before the deadline, CISA executed an option on the contract, extending funding for roughly eleven months and later describing the episode as a contract administration issue — language that reassured almost no one who had watched a 25-year-old pillar of global security nearly disappear over a paperwork decision.

The near-miss changed behavior more than the extension did. Board members of the CVE program announced the CVE Foundation the same week, an independent nonprofit built explicitly so the system’s survival would no longer depend on a single government’s annual budget cycle. The lesson practitioners drew was uncomfortable but clear: the institution everyone assumed was permanent had been running on a one-year contract renewable at the discretion of one agency.

The Decentralized Ecosystem Taking Shape

Since the funding scare, vulnerability intelligence has been fragmenting into parallel structures, each hedging against the next failure. The landscape a security team must now track includes several distinct sources that did not exist, or barely existed, before 2024:

• The European Union Vulnerability Database, launched by ENISA in May 2025 under the NIS2 mandate, giving Europe its first sovereign catalog rather than a mirror of American data.
• CISA’s Vulnrichment project, which distributes the enrichment work the NVD can no longer complete alone across authorized partners publishing severity and exploitation data directly.
• The CVE Foundation, positioning itself as an alternative governance home for the identifier system if federal funding wavers again when the extension runs out.
• The Global CVE allocation system from Luxembourg’s CIRCL, a federated numbering architecture in which no single national operator can halt issuance.
• Open ecosystem feeds such as OSV, which cover open-source packages with machine-readable records and increasingly serve as the primary source for developer tooling.

Redundancy is genuine progress, but it carries a cost the old monoculture never had: the same flaw can now surface in different databases at different times, with different severity judgments and different affected-product claims. Reconciling those records is becoming a discipline of its own, and organizations that treated vulnerability data as a solved commodity are discovering it now requires active curation.

What the Episode Teaches About Trust

The deeper finding from 2024 and 2025 is that vulnerability tracking is not primarily a technical system — it is a trust system with a database attached. Enterprises patched on CVEs’ schedule because they believed the catalog was complete, timely, and neutral; the backlog and the funding lapse damaged all three beliefs at once. Rebuilding that confidence is now shared work: governments funding the infrastructure durably instead of annually, vendors publishing richer advisories at disclosure time rather than waiting for central enrichment, and communicators translating identifier soup into statements customers can act on. Firms that responded to flaws in their own products during this period learned that silence reads as concealment precisely when the central catalog itself is lagging — the burden of clarity has shifted from the database to the disclosing organization.

The system that names the world’s software flaws survived 2025 by hours, and the backlog behind it has still not been cleared. The parallel databases now emerging make a total blackout less likely, but they transfer real work onto every organization that once trusted a single feed — and they make disciplined, well-prepared public communication about vulnerabilities a core operational function rather than an afterthought.