GCVE, the Global CVE initiative, is an open and decentralised approach to identifying and publishing vulnerabilities, operated by CIRCL in Luxembourg. Participants called GNAs allocate their own identifiers. Existing CVE IDs map into a reserved namespace, so CVE-2023-40224 reads as GCVE-0-2023-40224. It sits alongside CVE rather than replacing it.
Definitions
GNA stands for GCVE Numbering Authority. Each GNA gets a unique numeric namespace and sets its own disclosure policy, without requesting blocks of IDs from a central authority. The GCVE site says eligible applicants include existing CVE Numbering Authorities, recognised CSIRTs and CERTs, and organizations that regularly publish vulnerability information. Requests go to the address the project lists.
CIRCL also maintains Vulnerability-Lookup, the open-source platform behind GCVE services.
What an identifier looks like
The format begins with the issuing authority's namespace: GCVE, then the GNA number, then a value. A common form adds a year and unique number, for example GCVE-1-2025-00001. Detailed allocation advice is in a document the project calls GCVE-BCP-04.
CVE and GCVE side by side
| Question | CVE | GCVE |
|---|---|---|
| Allocation model | CNAs under the CVE Program | GNAs, each in its own namespace |
| Where do existing CVE IDs fit | Native | Mapped into namespace 0 |
| Format | CVE-year-number | GCVE-GNA-year-number |
What should a product team do
Nothing urgent. Most of your scanners, customers and contracts still speak CVE. Practical steps:
- Keep requesting CVE IDs through your usual route. See who to ask for a CVE ID.
- Make sure your advisory format can hold more than one identifier for the same flaw, as GHSA and OSV already allow. Our identifier comparison shows the aliases pattern.
- If your tooling parses IDs with a strict CVE pattern, loosen it before a GCVE ID turns up in a feed.
- Watch whether your customers or regulators start asking for it. If they do not, there is no need to act.
Why it exists
The project describes decentralisation as the point: participants manage their own allocation and disclosure. Whether that proves useful is a question for the community to settle, so treat claims about its adoption with care until you see data.
Quick check
Does GCVE replace CVE?
No. CVE IDs map into GCVE namespace 0, so the two coexist.
Who can become a GNA?
The project lists existing CNAs, recognised CSIRTs and CERTs, and organizations that regularly publish vulnerability information as eligible.
Safeguard's SBOM and dependency scanning works from the advisory data your tools consume, and you can start with a free scan.
Sources
Last reviewed: 19 October 2026.
