Information from GMO Prime Strategy Co., Ltd.
Vulnerability ID:JVNVU#92635551
Title:KUSANAGI vulnerable to HTTP header injection
Status:Vulnerable
This is a statement from the vendor itself with no modification by JPCERT/CC.
An HTTP header injection vulnerability (CVE-2026-117477) exists in WordPress profiles provisioned with KUSANAGI.
[Affected Products]
WordPress profiles provisioned with KUSANAGI 7, KUSANAGI 8, and KUSANAGI 9 are affected. Systems using Apache httpd are not affected.
[Remediation]
The vulnerability has been fixed in the following versions of KUSANAGI 9:
- Free / Business / Premium Edition: 9.12.3-1 or later
- Security / Enterprise Edition: 10.7.3-1 or later
KUSANAGI 7 and KUSANAGI 8 have reached end of support, and no updates will be provided. Mitigation measures involving changes to the Nginx configuration are available.
For details on affected versions, update procedures, and mitigation measures, please refer to our security advisory:
HTTP Header Injection Vulnerability in KUSANAGI (CVE-2026-117477)