It has now been over 4 months without CVE being assigned by #MITRE CNA-LR (I have 4 CANs pending). I can only conclude that the programme is dead by any practical measure. MITRE should acknowledge this in public so that the CVEs can be requested from parties that are actually functional.
We're rapidly approaching a situation where vulnerabilities will be discussed without a CVE ID being assigned to them. This is not working as intended.
