CVE-2026-42253

Published Jun 1, 2026

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42253 describes an Improper Neutralization of Input During Web Page Generation, commonly known as a 'Cross-site Scripting' vulnerability, found in Apache ActiveMQ and Apache ActiveMQ Web. The flaw specifically resides within the MessageServlet of the ActiveMQ web console API. This servlet copies Java Message Service (JMS) message properties directly into HTTP response headers without proper validation. This oversight allows an attacker to potentially overwrite or inject security headers by manipulating JMS messages. Such an action could facilitate cross-site scripting attacks. The vulnerability impacts Apache ActiveMQ versions prior to 5.19.7, and versions from 6.0.0 before 6.2.6. The same version ranges are affected for Apache ActiveMQ Web. To address this, users are advised to upgrade to Apache ActiveMQ 5.19.7 or 6.2.6, where the MessageServlet has been deprecated and disabled by default.

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.
Source: security@apache.org
NVD status: Analyzed
Products: activemq, activemq_web

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
            "versionEndExcluding": "5.19.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
            "versionEndExcluding": "6.2.6",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F12E08BD-3094-4096-8162-B98B0004B5AF",
            "versionEndExcluding": "5.19.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FAFD6F1A-7E2E-4611-A84F-BA7A28E555D2",
            "versionEndExcluding": "6.2.6",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.