CVE-2026-42253

medium

Published 2026-06-01 · Modified 2026-06-03

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.1

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Predictions

Exploit likelihood

71%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-42253 NameCVE-2026-42253 DescriptionImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on…

CVE-2026-42253

Name	CVE-2026-42253
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
activemq (PTS)	bullseye	5.16.1-1	vulnerable
	bullseye (security)	5.16.1-1+deb11u2	vulnerable
	bookworm, bookworm (security)	5.17.2+dfsg-2+deb12u1	vulnerable
	sid, trixie	5.17.6+dfsg-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
activemq	source	(unstable)	(unfixed)

Notes

https://www.openwall.com/lists/oss-security/2026/05/31/17

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://www.openwall.com/lists/oss-security/2026/05/31/17

OS impact

Debian Affected 4 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Affected	—
bullseye	Affected	—
bookworm	Affected	—

Application impact

Vendor	Product	Versions	Fixed
apache	activemq	`{"endExcluding":"5.19.7"}`	`5.19.7`
apache	activemq	`{"startIncluding":"6.0.0","endExcluding":"6.2.6"}`	`6.2.6`
apache	activemq_web	`{"endExcluding":"5.19.7"}`	`5.19.7`
apache	activemq_web	`{"startIncluding":"6.0.0","endExcluding":"6.2.6"}`	`6.2.6`

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.