CVE-2026-117477

MediumCVSS 6.1/10Last modified Nov 12, 2026

Description

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-113

Affected software

VendorProductVersions
GMO Prime Strategy Co., Ltd.KUSANAGI 7 Security Edition<= 10.7.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 7 Enterprise Edition<= 10.7.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 8 Security Edition<= 10.7.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 8 Enterprise Edition<= 10.7.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 9 Security Edition<= 10.7.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 9 Enterprise Edition<= 10.7.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 7 Free Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 7 Business Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 7 Premium Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 8 Free Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 8 Business Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 8 Premium Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 9 Free Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 9 Business Edition<= 9.12.2-1
GMO Prime Strategy Co., Ltd.KUSANAGI 9 Premium Edition<= 9.12.2-1

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-117486.9A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm suCVE-2026-117497.6A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing repCVE-2026-1174938.3Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an CVE-2026-1174993.7@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that rCVE-2026-11757.5A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GrCVE-2026-1175007.5HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every fiCVE-2026-1175017.5HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, useCVE-2026-1175035.3A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the componentCVE-2026-1175045.3A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/dCVE-2026-1175054.3A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the componCVE-2026-1175064.3A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInCVE-2026-1175075.4A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. Th
CVE-2026-117477: Medium severity, CVSS 6.1 | Vulnix