Not rated
CVE-2026-42253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ,…
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ActiveMQ 6.0 | 6.0.0 → < 6.2.6 | 6.2.6 |
| Apache ActiveMQ 5.19 | earliest → < 5.19.7 | 5.19.7 |
| Apache ActiveMQ Web 6.0 | 6.0.0 → < 6.2.6 | 6.2.6 |
| Apache ActiveMQ Web 5.19 | earliest → < 5.19.7 | 5.19.7 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache ActiveMQ
The 40 CVEs of Apache ActiveMQ →
CVE-2026-108500
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Not rated
CVE-2026-108946
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Not rated
CVE-2026-111822
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Not rated
CVE-2026-111821
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Not rated