Uncle Sam abruptly turns off funding for CVE program. Yes, that CVE program - The Register

[justaprogressive]

US government funding for the world's CVE program – the centralized Common Vulnerabilities and Exposures database of product security flaws – ends Wednesday.

The 25-year-old CVE program plays a huge role in vulnerability management. It is responsible overseeing the assignment and organizing of unique CVE ID numbers, such as CVE-2014-0160 and CVE-2017-5754, for specific vulnerabilities, in this case OpenSSL's Heartbleed and Intel's Meltdown, so that when referring to particular flaws and patches, everyone is agreed on exactly what we're all talking about.

It is used by companies big and small, developers, researchers, the public sector, and more as the primary system for identifying and squashing bugs. When multiple people find the same hole, CVEs are useful for ensuring everyone is working toward that one specific issue.

While the whole world's vulnerability management efforts aren't going to descend into chaos overnight, there is a concern that in a month or two they may. The lack of US government funding means that, unless someone else steps in to fill the gap, this standardized system for naming and tracking vulnerabilities may falter or shut down, new CVEs may no longer be published, and the program's website may go offline.

Not-for-profit outfit MITRE has a contract with the US Department of Homeland Security to operate the CVE program, and on Tuesday the group confirmed this arrangement has not been renewed. This comes as the Trump administration scours around the federal government for costs to trim.

https://www.theregister.com/2025/04/16/homeland_security_funding_for_cve/?td=rt-3a

[The Revolution]

1. Cui bono?

Russia, China, North Korea, & Iran all engage in state-sponsored cyber attacks. This makes it easier for them to operate.

[CousinIT]

2. Heard about this last night from IT colleagues.

This kind of penny-wise and pound-foolish ignorance by goons who have no idea what government even does but are plowing through it with a woodchipper anyway, is going to be very costly in the end. Moreso than if they had left it the fuck alone to begin with.

Idiots.

[Irish_Dem]

3. Trump is deliberately turning over the US govt to our enemies.

We have to assume China, Russia, NK have everything now.

[BoRaGard]

4. G.O.P. not just dumbing down US citizens, also dumbing down our digital safety

so unAmerican, so underhanded, such a betrayal of our nation.

[CousinIT]

5. CISA extends funding to ensure 'no lapse in critical CVE services'

https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/

CISA says the U.S. government has extended MITRE's funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program.

"The CVE Program is invaluable to cyber community and a priority of CISA," the U.S. cybersecurity agency told BleepingComputer. "Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners' and stakeholders' patience."

BleepingComputer has learned that the extension of the contract is for 11 months.

The announcement follows a warning from MITRE Vice President Yosry Barsoum that government funding for the CVE and CWE programs was set to expire today, April 16, potentially leading to widespread disruption across the cybersecurity industry.

"If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure," Barsoum said.

MITRE maintains CVE, a widely adopted program that provides accuracy, clarity, and shared standards when discussing security vulnerabilities, with funding from the U.S. National Cyber Security Division of the U.S. Department of Homeland Security (DHS).