A flaw allows an attacker to inject arbitrary HTTP headers into responses by accessing a specially crafted URL. The injected headers directly alter the response sent to clients, undermining the integrity of the responses. The CVE description does not detail further downstream attacks such as response splitting or spoofed content; any such consequences are merely inferred if they were to occur, but are not explicitly stated in the input.

All KUSANAGI editions from version 7 through 9—Business, Enterprise, Free, Premium, and Security—are listed as affected by GMO Prime Strategy Co., Ltd. No specific version numbers are given, indicating that any current deployment of these editions may be vulnerable.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score is not available, making the current exploitation probability unclear. The vulnerability is not listed in KEV, suggesting no widespread exploitation evidence yet. Attackers would need to craft a URL that reaches the vulnerable application, implying exposure to the network or internet. Because the flaw involves response header manipulation, it could be exploited for phishing, session hijacking, or other injection attacks if additional conditions, such as response splitting, are satisfied. The impact is limited to the content served by the affected application but may be amplified if the application is used in a wider infrastructure context.