CVE-2026-42253: Apache ActiveMQ XSS and header injection in MessageServlet

CVE-2026-42253 · Severity: medium · CVSS 6.1 · Published 2026-06-01

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in its web console API allows attackers to inject malicious content or manipulate security headers by sending specially crafted messages. This could lead to unauthorized actions being performed in a user's browser or the bypass of security protections, potentially compromising sensitive data or administrative sessions.

Technologies: org.apache.activemq:apache-activemq (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-42253 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42253 being exploited in the wild.
How severe is CVE-2026-42253?
Medium severity, with a CVSS score of 6.1, published 1 June 2026.
Which products and versions are affected?
Apache Software Foundation ActiveMQ Web < 5.19.7, >= 6.0.0 < 6.2.6, < 5.19.7, 6.0.0 to < 6.2.6; org.apache.activemq:activemq-web (Maven) ECOSYSTEM:introduced=0,fixed=5.19.7; org.apache.activemq:apache-activemq (Maven) ECOSYSTEM:introduced=0,fixed=5.19.7.
Is there a fix for CVE-2026-42253?
Yes. org.apache.activemq:activemq-web (Maven): upgrade to 5.19.7 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42253 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42253?
Check whether you run Apache Software Foundation ActiveMQ Web, org.apache.activemq:activemq-web (Maven) or org.apache.activemq:apache-activemq (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:activemq-web (Maven): upgrade to 5.19.7 or later
    # set org.apache.activemq:activemq-web to 5.19.7 in your pom.xml or build.gradle
  • org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.7 or later
    # set org.apache.activemq:apache-activemq to 5.19.7 in your pom.xml or build.gradle

Technical details

A Cross-Site Scripting (XSS) and HTTP response header injection vulnerability exists in the MessageServlet component of the Apache ActiveMQ web console API. The root cause is the lack of validation when the servlet copies JMS message properties directly into HTTP response headers. A remote attacker can exploit this by sending a JMS message with malicious properties that, when retrieved via the API, inject or overwrite security headers or execute scripts in the context of the user's browser. The vulnerability is fixed in versions 5.19.7 and 6.2.6, where MessageServlet has been deprecated and disabled by default.

Affected products

  • Apache ActiveMQ < 5.19.7, >= 6.0.0 < 6.2.6
  • Apache ActiveMQ Web < 5.19.7, >= 6.0.0 < 6.2.6

Identifiers

  • CVE-2026-42253
  • GHSA-8wm6-6fqh-phmc

Timeline

  • 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
  • 2026-06-01: advisory: NVD and GitHub Advisory published
  • 2026-06-01: patched: Fixes released in versions 5.19.7 and 6.2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.