The glibc team could certainly have been a little less guarded, but I'm not sure they were wrong. If CVEs are to be something other than a stamp collection, the

The glibc team could certainly have been a little less guarded, but I'm not sure they were wrong. If CVEs are to be something other than a stamp collection, then they need to facilitate remediation. To do that, CVEs need to identify vulnerabilities specifically and not just in general. For example, it wouldn't be useful to assign a CVE to the concept of SQLi, but it can be useful to assign CVEs to particular products exhibiting SQLi vulnerabilities. This fault isn't quite as general as that, but the argument for non-CVE-assignment goes along the same lines.