CVE-2026-42253

published 2026-06-01

CVE-2026-42253: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet…

Priority P4 28 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

The MessageServlet in the ActiveMQ web console API copies every JMS message
property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apache	activemq	< 5.19.7	5.19.7
apache	activemq	>= 6.0.0 < 6.2.6	6.2.6
apache	activemq_web	< 5.19.7	5.19.7
apache	activemq_web	>= 6.0.0 < 6.2.6	6.2.6
apache_software_foundation	apache_activemq	< 5.19.7	5.19.7
apache_software_foundation	apache_activemq	>= 6.0.0 < 6.2.6	6.2.6
apache_software_foundation	apache_activemq_web	< 5.19.7	5.19.7
apache_software_foundation	apache_activemq_web	>= 6.0.0 < 6.2.6	6.2.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79