Read the docs
TI-2026-30569 Aliases CVE-2026-42253GHSA-8wm6-6fqh-phmc

Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01018 63rd percentileScored 2026-11-07
Fix Fixed Apache ActiveMQ (Apache Software Foundation): 5.19.7, 6.2.6Apache ActiveMQ Web (Apache Software Foundation): 5.19.7, 6.2.6+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ActiveMQbefore 5.19.7; 6.0.0 to before 6.2.65.19.7, 6.2.6Patch availableCNA
ApacheApache ActiveMQ Webbefore 5.19.7; 6.0.0 to before 6.2.65.19.7, 6.2.6Patch availableCNA
—org.apache.activemq:apache-activemq (Maven)before 5.19.75.19.7Patch availableGHSA-8wm6-6fqh-phmc
—org.apache.activemq:apache-activemq (Maven)6.0.0 to before 6.2.66.2.6Patch availableGHSA-8wm6-6fqh-phmc
—org.apache.activemq:activemq-web (Maven)before 5.19.75.19.7Patch availableGHSA-8wm6-6fqh-phmc
—org.apache.activemq:activemq-web (Maven)6.0.0 to before 6.2.66.2.6Patch availableGHSA-8wm6-6fqh-phmc
  • Apache ActiveMQ VendorApache Affected before 5.19.7; 6.0.0 to before 6.2.6 Fixed in 5.19.7, 6.2.6 Patch available CNA
  • Apache ActiveMQ Web VendorApache Affected before 5.19.7; 6.0.0 to before 6.2.6 Fixed in 5.19.7, 6.2.6 Patch available CNA
  • org.apache.activemq:apache-activemq (Maven) Vendor— Affected before 5.19.7 Fixed in 5.19.7 Patch available GHSA-8wm6-6fqh-phmc
  • org.apache.activemq:apache-activemq (Maven) Vendor— Affected 6.0.0 to before 6.2.6 Fixed in 6.2.6 Patch available GHSA-8wm6-6fqh-phmc
  • org.apache.activemq:activemq-web (Maven) Vendor— Affected before 5.19.7 Fixed in 5.19.7 Patch available GHSA-8wm6-6fqh-phmc
  • org.apache.activemq:activemq-web (Maven) Vendor— Affected 6.0.0 to before 6.2.6 Fixed in 6.2.6 Patch available GHSA-8wm6-6fqh-phmc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*before 5.19.7; 6.0.0 to before 6.2.6VulnerableApache
cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*before 5.19.7; 6.0.0 to before 6.2.6VulnerableApache
  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.19.7; 6.0.0 to before 6.2.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:* Versions before 5.19.7; 6.0.0 to before 6.2.6 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache ActiveMQ (Apache Software Foundation) Fixed in 5.19.7, 6.2.6
  • Fix · CNA Apache ActiveMQ Web (Apache Software Foundation) Fixed in 5.19.7, 6.2.6
  • Fix · GHSA-8wm6-6fqh-phmc org.apache.activemq:apache-activemq (Maven) Fixed in 5.19.7 Advisory →
  • Fix · GHSA-8wm6-6fqh-phmc org.apache.activemq:apache-activemq (Maven) Fixed in 6.2.6 Advisory →
  • Fix · GHSA-8wm6-6fqh-phmc org.apache.activemq:activemq-web (Maven) Fixed in 5.19.7 Advisory →
  • Fix · GHSA-8wm6-6fqh-phmc org.apache.activemq:activemq-web (Maven) Fixed in 6.2.6 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache ActiveMQ 5.19.7, 6.2.6

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-33275 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper BypassPriority MEDIUM 41
    • TI-2026-36361 Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by defaultPriority MEDIUM 40
    • TI-2026-30868 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorPriority LOW 39
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42253
  2. 2026-10-03 Alias added: GHSA-8wm6-6fqh-phmc

References

Advisory 3

Other 1

  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences