Exception to problem type requirement

[zmanion]

Current rule:

5.1.7 MUST identify the type of Vulnerability. The CVE record SHOULD use the Common Weakness Enumeration (CWE™) to classify the type or cause of the Vulnerability. A CVE Record MAY contain multiple types or causes of the Vulnerability.

Waxing somewhat philosophical, knowing the type of the vulnerability is logically not necessary to assert (or believe) that a vulnerability exists and to at least start vulnerability management activities.

Two examples where it was valuable to assign CVE IDs without problemTypes:

https://www.cve.org/CVERecord?id=CVE-2024-9537

https://www.cve.org/CVERecord?id=CVE-2025-34158 (problemType was added after initial publication)

An example where a CVE ID has not been assigned, possibly due to the inability to determine problemType:

https://invisioncommunity.com/release-notes-v5/507-r41/

Options include:

1. Broadly relaxing 5.1.7 from MUST to SHOULD. Discussion in the SPWG lead to the opinion that this is not the way.
2. Add an exception to the rules so that a CVE Record MAY be published lacking problemType, but only in cases in which the information is unavailable. These cases may be rare, however two examples are cited above. problemType SHOULD be added to the Record as soon as possible after publication.
3. A variant of 2, add support for a special "not available" problemType, similar to the NVD "NVD-CWE-noinfo" value. This might require a CVE Record Format schema update.
4. Require first-party CNAs (usually but not limited to Supplier CNAs) to provide problemType. If a CNA is going to assign and publish for a vulnerability the CNA is technically familiar with (discovered, reported, fixed), then the CNA is able to provide a problemType.
5. The exception (2.) could be granted only for non-first-party CNAs and require use of a special value (3.)

[zmanion]

Editorial note, Section 5.1 in the PDF is missing the sentence "This section defines the minimum content required in a CVE Record. A CVE Record:"

[zmanion]

Proposed rule change:

[A CVE Record:]

5.1.7 MUST identify the type of Vulnerability. The CVE record SHOULD use the Common Weakness Enumeration (CWE™) to classify the type or cause of the Vulnerability. A CVE Record MAY contain multiple types or causes of the Vulnerability.

5.1.7.1 MAY use the special value "not-available" in the CVE Record only when the CNA is not able to determine the problem type. The CNA MUST provide a more specific problem type when sufficient information becomes available.

[kernelsmith]

CWE-000 could be used w/o modifying the JSON schema (I believe) and CWE-000 is not used by an official CWE AFAIK. We use CWE-000 No CWE, but "No CWE" could be whatever string is needed. If additional "placeholder" CWEs are required, like CWE-NNN TBD etc, one could petition the CWE program for additional CWE reservations that aren't currently used, like CWE-999 if 999 is not currently in use.