Not rated
CVE-2026-41043 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache…
Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ActiveMQ 6.0 | 6.0.0 → < 6.2.5 | 6.2.5 |
| Apache ActiveMQ 5.19 | earliest → < 5.19.6 | 5.19.6 |
| Apache ActiveMQ Web 6.0 | 6.0.0 → < 6.2.5 | 6.2.5 |
| Apache ActiveMQ Web 5.19 | earliest → < 5.19.6 | 5.19.6 |
References
- activemq.apache.org activemq.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache ActiveMQ
The 40 CVEs of Apache ActiveMQ →
CVE-2026-108500
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Not rated
CVE-2026-108946
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Not rated
CVE-2026-111822
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Not rated
CVE-2026-111821
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Not rated