HTTP response splitting in GMO Prime Strategy products - CVE-2026-117477
Published: November 9, 2026
Vulnerability identifier: #VU162578
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-117477
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform HTTP splitting attacks.
The vulnerability exists due to software does not correclty process CRLF character sequences in HTTP headers. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.
Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.
Affected software
KUSANAGI Security Edition
KUSANAGI Enterprise Edition
KUSANAGI Free Edition
KUSANAGI Business Edition
KUSANAGI Premium Edition
KUSANAGI Enterprise Edition
KUSANAGI Free Edition
KUSANAGI Business Edition
KUSANAGI Premium Edition
How to mitigate CVE-2026-117477
Install updates from vendor's website.
KUSANAGI Security Edition - update to 10.7.3-1
KUSANAGI Enterprise Edition - update to 10.7.3-1
KUSANAGI Free Edition - update to 9.12.3-1
KUSANAGI Business Edition - update to 9.12.3-1
KUSANAGI Premium Edition - update to 9.12.3-1
KUSANAGI Enterprise Edition - update to 10.7.3-1
KUSANAGI Free Edition - update to 9.12.3-1
KUSANAGI Business Edition - update to 9.12.3-1
KUSANAGI Premium Edition - update to 9.12.3-1