The blame here lies with the MITRE corporation. They have over the years received millions of dollars to operate that program, and have completely abdicated at

The blame here lies with the MITRE corporation. They have over the years received millions of dollars to operate that program, and have completely abdicated at this point. First they started farming out CVE assignments, then they stopped interacting with oss-sec, now they just rubberstamp whatever spam comes in their report queue. The CVE program is failing, and it got so bad that passersby with little expertise smelled money, so now we have the failed DWF and the even-quicker-failed UVI, followed by the soon-to-fail GSD. It's been almost a decade now that MITRE has been mismanaging the resources entrusted to it. I wish to God they'd hire someone who cares enough to fix it.