---
id: "CVE-2026-117477"
page: "https://infrastack.ai/live/CVE-2026-117477"
kind: "vulnerability"
aliases: ["CVE-2026-117477"]
title: "KUSANAGI: crafted URL lets attackers inject HTTP response headers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["kusanagi", "other"]
not_affected_if: []
published_at: "2026-11-10T00:17:05+00:00"
first_seen_at: "2026-11-10T00:28:41+00:00"
updated_at: "2026-11-10T00:30:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117477", "first_seen_at": "2026-11-10T00:28:41+00:00"}]
exploit_sources: []
---

# KUSANAGI: crafted URL lets attackers inject HTTP response headers

Link for people: https://infrastack.ai/live/CVE-2026-117477 (this .md is for agents)

KUSANAGI, a web server stack from GMO Prime Strategy, has an HTTP header injection flaw. A user who opens a specially crafted URL can have arbitrary HTTP headers added to the response.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T00:28:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117477

## From the sources

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_