Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-42253
Analyzed
More InfoOfficial Page
Source-security@apache.org
View Known Exploited Vulnerability (KEV) details
Published At-01 Jun, 2026 | 09:16
Updated At-01 Jun, 2026 | 17:06

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.16.1MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary3.16.1MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Type: Primary
Version: 3.1
Base score: 6.1
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Type: Secondary
Version: 3.1
Base score: 6.1
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE Matches
The Apache Software Foundation
apache
>>activemq>>Versions before 5.19.7(exclusive)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
The Apache Software Foundation
apache
>>activemq>>Versions from 6.0.0(inclusive) to 6.2.6(exclusive)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
The Apache Software Foundation
apache
>>activemq_web>>Versions before 5.19.7(exclusive)
cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*
The Apache Software Foundation
apache
>>activemq_web>>Versions from 6.0.0(inclusive) to 6.2.6(exclusive)
cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-79Secondarysecurity@apache.org
CWE ID: CWE-79
Type: Secondary
Source: security@apache.org
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00security@apache.org
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/31/17af854a3a-2127-422b-91ae-364da2661108
Mailing List
Third Party Advisory
Hyperlink: https://lists.apache.org/thread/j9vmlc410ht5f28fc98gx75jcbq62j00
Source: security@apache.org
Resource:
Mailing List
Vendor Advisory
Hyperlink: http://www.openwall.com/lists/oss-security/2026/05/31/17
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Mailing List
Third Party Advisory
Change History
0Changes found
Details not found