CVE-2026-42253: Apache ActiveMQ HTTP Response Header Injection Vulnerability
Summary
CVE-2026-42253: Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties. Affects activemq across 2 version ranges.
< 5.19.7
>= 6.0.0, < 6.2.6
Fixed in 5.19.7 or 6.2.6, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-42253 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache ActiveMQ is an open-source messaging server that facilitates communication between different applications through the Java Message Service (JMS) API. It supports various messaging protocols and provides features like message persistence, transactions, and clustering. However, certain versions of ActiveMQ and its web console are vulnerable to an HTTP response header injection flaw, which can compromise security by allowing unauthorized modifications to HTTP headers.
Vulnerability Detail
The vulnerability arises from the MessageServlet in the ActiveMQ web console API, which inadequately sanitizes JMS message properties before copying them into HTTP response headers. This oversight can lead to the injection of malicious headers, potentially allowing attackers to overwrite security-critical headers. The affected versions include Apache ActiveMQ before 5.19.7 and from 6.0.0 before 6.2.6. Exploiting this vulnerability could result in unauthorized access or manipulation of web console functionalities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.75.19.7 -
>= 6.0.0, < 6.2.66.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can disable the MessageServlet, which has been deprecated and is disabled by default in newer versions. This can help mitigate the risk until an upgrade can be performed.
Conclusion
CVE-2026-42253 represents a significant security risk for users of Apache ActiveMQ and its web console. It is crucial for affected users to upgrade to the latest versions to protect against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for activemq →
FAQ
CVE-2026-42253 is a vulnerability in Apache ActiveMQ that allows HTTP response header injection through JMS message properties.
The vulnerability affects Apache ActiveMQ versions before 5.19.7 and from 6.0.0 before 6.2.6.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access, manipulation of HTTP headers, and potential security breaches.
If an immediate upgrade is not possible, consider disabling the MessageServlet as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
