Skip to content
Fencer Intel
medium 6.1

CVE-2026-117477 json

KUSANAGI provided by GMO Prime Strategy Co., Ltd.

published 2d ago modified 4h ago also EUVD-2026-120519

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

Is CVE-2026-117477 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • GMO Prime Strategy Co., Ltd. KUSANAGI 7
  • GMO Prime Strategy Co., Ltd. KUSANAGI 9 Security Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 9 Enterprise Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 8 Free Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 8 Business Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 8 Premium Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 9 Free Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 9 Business Edition
  • GMO Prime Strategy Co., Ltd. KUSANAGI 9 Premium Edition

Classification

Weakness
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.