Log in Start free

Vulnerability · Published Jun 1, 2026 · Assigned by apache

CVE-2026-42253Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

Medium 6.1

In plain English

A medium-severity cross-site scripting in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)1.0%top 36.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12activemqno fix listedDEBIAN-CVE-2026-42253
Debian:13activemqno fix listedDEBIAN-CVE-2026-42253
Mavenorg.apache.activemq:activemq-web5.19.7GHSA-8wm6-6fqh-phmc
Mavenorg.apache.activemq:activemq-web6.2.6GHSA-8wm6-6fqh-phmc
Mavenorg.apache.activemq:apache-activemq5.19.7GHSA-8wm6-6fqh-phmc
Mavenorg.apache.activemq:apache-activemq6.2.6GHSA-8wm6-6fqh-phmc
Ubuntu:24.04:LTSactivemqno fix listedUBUNTU-CVE-2026-42253
Ubuntu:25.10activemqno fix listedUBUNTU-CVE-2026-42253
Ubuntu:26.04:LTSactivemqno fix listedUBUNTU-CVE-2026-42253
Ubuntu:26.10activemqno fix listedUBUNTU-CVE-2026-42253

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache ActiveMQ 0 – before 5.19.76.0.0 – before 6.2.6
Apache Software Foundation Apache ActiveMQ Web 0 – before 5.19.76.0.0 – before 6.2.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References