Vulnerability-Lookup

CVE-2026-42253 (GCVE-0-2026-42253)

Vulnerability from cvelistv5 – Published: 2026-06-01 07:23 – Updated: 2026-06-01 13:12

Title

Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

apache

References

2 references

URL	Tags
https://lists.apache.org/thread/j9vmlc410ht5f28fc…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

2 products

Vendor	Product	Version
Apache Software Foundation	Apache ActiveMQ	Affected: 0 , < 5.19.7 (semver) Affected: 6.0.0 , < 6.2.6 (semver)
Apache Software Foundation	Apache ActiveMQ Web	Affected: 0 , < 5.19.7 (semver) Affected: 6.0.0 , < 6.2.6 (semver)

Credits

Vishal Shukla pyn3rd uname 4ra1n

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-01T07:47:36.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/31/17"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42253",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T13:12:19.333750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T13:12:40.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-web",
          "product": "Apache ActiveMQ Web",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vishal Shukla"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "pyn3rd"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "uname"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "4ra1n"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\u003c/p\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe MessageServlet in the ActiveMQ web console API copies every JMS message\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe MessageServlet has now been deprecated and disabled by default.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nThe MessageServlet in the ActiveMQ web console API copies every JMS message\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\n\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\u00a0The MessageServlet has now been deprecated and disabled by default."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T07:23:50.962Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-42253",
    "datePublished": "2026-06-01T07:23:50.962Z",
    "dateReserved": "2026-04-25T19:48:04.140Z",
    "dateUpdated": "2026-06-01T13:12:40.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42253",
      "date": "2026-06-02",
      "epss": "0.00169",
      "percentile": "0.37734"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42253\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-06-01T09:16:18.673\",\"lastModified\":\"2026-06-01T17:06:34.850\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\\n\\nThe MessageServlet in the ActiveMQ web console API copies every JMS message\\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\\n\\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\\n\\nUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\u00a0The MessageServlet has now been deprecated and disabled by default.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.19.7\",\"matchCriteriaId\":\"793E68E6-9024-4518-B062-42B2DE5BB555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.2.6\",\"matchCriteriaId\":\"FFF44DB9-1850-4B5F-AD0F-55CB5219AB22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.19.7\",\"matchCriteriaId\":\"F12E08BD-3094-4096-8162-B98B0004B5AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.2.6\",\"matchCriteriaId\":\"FAFD6F1A-7E2E-4611-A84F-BA7A28E555D2\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/31/17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/31/17\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-06-01T07:47:36.520Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42253\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-01T13:12:19.333750Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-01T13:12:36.334Z\"}}], \"cna\": {\"title\": \"Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Vishal Shukla\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"pyn3rd\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"uname\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"4ra1n\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache ActiveMQ\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.19.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.2.6\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.activemq:apache-activemq\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache ActiveMQ Web\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.19.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.2.6\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.activemq:activemq-web\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\\n\\nThe MessageServlet in the ActiveMQ web console API copies every JMS message\\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\\n\\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\\n\\nUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\\u00a0The MessageServlet has now been deprecated and disabled by default.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\u003c/p\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe MessageServlet in the ActiveMQ web console API copies every JMS message\\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe MessageServlet has now been deprecated and disabled by default.\u003c/span\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-06-01T07:23:50.962Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42253\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T13:12:40.804Z\", \"dateReserved\": \"2026-04-25T19:48:04.140Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-06-01T07:23:50.962Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42253

Vulnerability from fkie_nvd - Published: 2026-06-01 09:16 - Updated: 2026-06-01 17:06

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00	Mailing List, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/05/31/17	Mailing List, Third Party Advisory

Impacted products

Vendor	Product	Version
apache	activemq	*
apache	activemq	*
apache	activemq_web	*
apache	activemq_web	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
              "versionEndExcluding": "5.19.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F12E08BD-3094-4096-8162-B98B0004B5AF",
              "versionEndExcluding": "5.19.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAFD6F1A-7E2E-4611-A84F-BA7A28E555D2",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nThe MessageServlet in the ActiveMQ web console API copies every JMS message\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\n\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\u00a0The MessageServlet has now been deprecated and disabled by default."
    }
  ],
  "id": "CVE-2026-42253",
  "lastModified": "2026-06-01T17:06:34.850",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-01T09:16:18.673",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/17"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-8WM6-6FQH-PHMC

Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-06-01 15:30

Details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-42253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T09:16:18Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nThe MessageServlet in the ActiveMQ web console API copies every JMS message\nproperty into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.\n\nThis issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.\u00a0The MessageServlet has now been deprecated and disabled by default.",
  "id": "GHSA-8wm6-6fqh-phmc",
  "modified": "2026-06-01T15:30:40Z",
  "published": "2026-06-01T09:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42253"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1741

Vulnerability from csaf_certbund - Published: 2026-05-31 22:00 - Updated: 2026-06-01 22:00

Summary

Apache ActiveMQ: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuführen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-42253

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-42588

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-45505

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-46605

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-49157

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-49270

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

References

9 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.data	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1741 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1741.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1741 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1741"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-42253-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-42588-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-46605-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-49270-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache ActiveMQ: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-01T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-02T05:12:27.283+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1741",
      "initial_release_date": "2026-05-31T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-31T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-01T22:00:00.000+00:00",
          "number": "2",
          "summary": "Link zu CVE-2026-46605 korrigiert"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.19.7",
                "product": {
                  "name": "Apache ActiveMQ \u003c5.19.7",
                  "product_id": "T054887"
                }
              },
              {
                "category": "product_version",
                "name": "5.19.7",
                "product": {
                  "name": "Apache ActiveMQ 5.19.7",
                  "product_id": "T054887-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:activemq:5.19.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.2.6",
                "product": {
                  "name": "Apache ActiveMQ \u003c6.2.6",
                  "product_id": "T054888"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.6",
                "product": {
                  "name": "Apache ActiveMQ 6.2.6",
                  "product_id": "T054888-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:activemq:6.2.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveMQ"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42253",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-42253"
    },
    {
      "cve": "CVE-2026-42588",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-42588"
    },
    {
      "cve": "CVE-2026-45505",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-45505"
    },
    {
      "cve": "CVE-2026-46605",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-46605"
    },
    {
      "cve": "CVE-2026-49157",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-49157"
    },
    {
      "cve": "CVE-2026-49270",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-49270"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42253 (GCVE-0-2026-42253)

FKIE_CVE-2026-42253

GHSA-8WM6-6FQH-PHMC

WID-SEC-W-2026-1741

Tags

Sightings

Nomenclature