Published:2026/11/09  Last Updated:2026/11/09

JVNVU#92635551
KUSANAGI vulnerable to HTTP header injection

Overview

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability.

Products Affected

The following versions of KUSANAGI 7, KUSANAGI 8, and KUSANAGI 9:

  • Security / Enterprise Edition versions 10.7.2-1 and earlier
  • Free / Business / Premium Edition versions 9.12.2-1 and earlier
Note that systems using Apache httpd as the web server are not affected by this vulnerability.

Description

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains the following vulnerability in a redirect rule included in the Nginx configuration for WordPress:

  • Improper Neutralization of CRLF Sequences in HTTP Headers (CWE-113)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N Base Score 5.1
    • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score 6.1
    • CVE-2026-117477

Impact

Arbitrary headers may be injected into the HTTP response when a user accesses a specially crafted URL.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

Apply the Workaround
If the affected product cannot be updated, implement mitigation measures according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
GMO Prime Strategy Co., Ltd. Vulnerable 2026/11/09 GMO Prime Strategy Co., Ltd. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

GMO Prime Strategy Co., Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. GMO Prime Strategy Co., Ltd. and JPCERT/CC coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-117477
JVN iPedia