CVE not assigned for published advisory GHSA-hp8h-jqfm-v7x5 (Athou/commafeed) #9761

I'm the reporter credited on GHSA-hp8h-jqfm-v7x5 (Host header injection in password reset/logout, CommaFeed <= 7.3.0, fixed in 7.3.1). The maintainer (@Athou) requested a CVE through the advisory and published it on Aug 17, 2026. The advisory still shows "No known CVE" five weeks later.

Could you check whether the CVE request was received, declined, or dropped, and assign an ID if the advisory is eligible?

Advisory: GHSA-hp8h-jqfm-v7x5