Both of your examples are for Curl. Daniel isn't a "CVE Numbering Authority", so he can't arbitrarily reject CVEs for Curl that he doesn't want to acknowledge.

Both of your examples are for Curl. Daniel isn't a "CVE Numbering Authority", so he can't arbitrarily reject CVEs for Curl that he doesn't want to acknowledge. Big software vendors generally are[0] and have much more leeway in deciding to grant a CVE or not for their own products. The two examples you provided are a problem, but so is the current CNA system that is an inherent conflict of interest. 0 - https://www.cve.org/PartnerInformation/ListofPartners https://www.cve.org/PartnerInformation/ListofPartners