CVE-2026-42253: Apache ActiveMQ Cross-site Scripting Vulnerability
Summary
CVE-2026-42253: Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue. Affects org.apache.activemq:apache-activemq across 2 version ranges.
< 5.19.7
>= 6.0.0, < 6.2.6
Fixed in 5.19.7 or 6.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- activemq · Bitnami
The same CVE-2026-42253 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between applications through the Java Message Service (JMS) API. It is widely used for its ability to support various messaging protocols and its robust features, including message persistence, clustering, and high availability. However, certain versions of ActiveMQ and its web console are vulnerable to a Cross-site Scripting (XSS) issue, which can compromise the security of applications using this messaging service.
Vulnerability Detail
The vulnerability arises from the MessageServlet in the ActiveMQ web console API, which improperly neutralizes input during web page generation. Specifically, it copies every JMS message property into an HTTP response header without validation. This flaw allows attackers to overwrite and inject security headers by manipulating JMS messages returned by the servlet. The potential ramifications include unauthorized access, data leakage, and the ability to execute malicious scripts in the context of the user's browser, leading to further exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.75.19.7 -
>= 6.0.0, < 6.2.66.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the MessageServlet, which has been deprecated and is disabled by default in the latest versions. This will prevent the exploitation of the vulnerability until an upgrade can be performed.
Conclusion
The Cross-site Scripting vulnerability in Apache ActiveMQ and ActiveMQ Web poses significant security risks due to improper input handling in the MessageServlet. Users are strongly advised to upgrade to the latest patched versions to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for org.apache.activemq:apache-activemq →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
The vulnerability affects Apache ActiveMQ versions before 5.19.7 and from 6.0.0 before 6.2.6, as well as Apache ActiveMQ Web in the same version range.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Failure to address this vulnerability can lead to unauthorized access, data leakage, and the execution of malicious scripts, which can compromise the security of your applications and users.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:apache-activemq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
