CVE-2026-42253: Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.
The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.7 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.6 - Configuration
Ensure the deprecated MessageServlet is disabled (it is disabled by default) because it copies JMS message properties into HTTP response headers without validation.
Apache ActiveMQ Web console API (MessageServlet) MessageServlet enabled = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42253?
The severity of CVE-2026-42253 is rated as medium with a score of 6.1.
How do I fix CVE-2026-42253?
To fix CVE-2026-42253, ensure that JMS message properties are properly validated or sanitized before being included in HTTP response headers.
What software is affected by CVE-2026-42253?
CVE-2026-42253 affects Apache ActiveMQ and Apache ActiveMQ Web.
What type of vulnerability is CVE-2026-42253?
CVE-2026-42253 is classified as a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input.
What can be the impact of exploiting CVE-2026-42253?
Exploitation of CVE-2026-42253 can lead to HTTP response header injection, potentially allowing attackers to manipulate client-side scripts.