It's becoming sufficiently difficult to get a CVE ID assigned that security researchers are discussing alternatives: https://lwn.net/Articles/679315/