VulnSocial

CVE-2026-42253Disclosure(apache / activemq)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache activemq systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • activemq
  • activemq_web

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 5d ago at 1 mentions (2026-05-31); latest day: 1
  • 6 total mentions across 6 days

Affected systems

Vendors
apache
Products
activemqactivemq_web

Deep dive

Activity timeline6 mentions / 6d
00111Mentions · 2026-05-31: 1Mentions · 2026-06-01: 1Mentions · 2026-06-02: 1Mentions · 2026-06-03: 1Mentions · 2026-06-04: 1Mentions · 2026-06-11: 1Patch / Workaround · 2026-06-02: 1Patch / Workaround · 2026-06-04: 1Technical Details · 2026-06-01: 1Technical Details · 2026-06-02: 1Technical Details · 2026-06-03: 1Technical Details · 2026-06-04: 1Technical Details · 2026-06-11: 105-3106-0106-0206-0306-0406-11
Signal classification3 categories
Disclosure
350.0%
Patch
233.3%
General
116.7%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-05-311
General1
2026-06-011
Disclosure1
2026-06-021
Patch1
2026-06-031
Disclosure1
2026-06-041
Patch1
2026-06-111
Disclosure1
Full discourse6 posts
  • pyn3rd@pyn3rd
    Disclosure

    #CVE-2026-42253 Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties #CVE-2026-42588 Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector These two vulnerabilities we reported have been credited. https://t.co/S385zgrs2v

    Post summary

    The tweet announces the reporting of two ActiveMQ CVEs—an HTTP Response Header Injection and a Remote Code Execution via Jolokia—without any PoC, exploit code, patch info, or evidence of active exploitation.

    1202872.4K
    14.9K followersView on X
  • elhacker.NET@elhackernet
    Disclosure

    Vulnerabilidad crítica en Apache ActiveMQ permite inyecciones de encabezados de seguridad Se ha revelado una vulnerabilidad crítica en Apache ActiveMQ (identificada como CVE-2026-42253 ) que afecta a sus componentes web https://blog.elhacker.net/2026/06/vulnerabilidad-critica-en-apache.html

    Post summary

    The article announces a critical CVE-2026-42253 that permits header injections in Apache ActiveMQ web components, but it offers no proof of concept, exploit, patch, or evidence of active exploitation.

    040741.5K
    140.9K followersView on X
  • VulnTracker@vuln_tracker
    Patch

    Apache ActiveMQ is having a rough month. Two more CVEs. ⚠️ CVE-2026-42253 - HTTP Response Header Injection via JMS Message Properties ⚠️ CVE-2026-42588 - RCE via Jolokia addNetworkConnector The Jolokia one is the scary one - default access policy permits exec operations on all ActiveMQ MBeans. Fix: upgrade to 5.19.7 or 6.2.6. http://VulnTracker.io

    Post summary

    The post announces two new CVEs in Apache ActiveMQ, detailing an HTTP header injection and a remote code execution via Jolokia, and urges users to upgrade to the patched versions 5.19.7 or 6.2.6.

    011324.9K
    681 followersView on X
  • iototsecnews@iototsecnews
    Disclosure

    Apache ActiveMQ の脆弱性 CVE-2026-42253／49157 が FIX：セキュリティ・メカニズム回避の恐れ https://iototsecnews.jp/2026/06/03/critical-apache-activemq-vulnerability-exposes-systems-to-security-header-injection-attacks/ Apache ActiveMQ の脆弱性は、開発時の検証不足や設定が主な原因となっています。 CVE-2026-42253 は、MessageServlet が外部から入力された JMS メッセージプロパティの検証やサニタイズを行わずに、HTTP レスポンス・ヘッダーに対して、そのままコピーすることで発生します。 また、脆弱性 CVE-2026-49157 は、 Jolokia のデフォルトの認可設定が過度に許容的であり、本来は権限のない低権限ユーザーに管理者操作を許しています。ご利用のチームは、ご注意ください。 #ActiveMQ #Apache #CVE202642253 #CVE202649157 #Vulnerability

    Post summary

    The article discloses two CVEs affecting Apache ActiveMQ, detailing header injection and permissive authorization weaknesses, with no evidence of attacks, exploits, or existing patches.

    0000088
    497 followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Critical #ApacheActiveMQ vulnerability (CVE-2026-42253) allows malicious HTTP header injections, leading to potential XSS and response manipulation attacks. Upgrade to versions 5.19.7 or 6.2.6 immediately. Link: https://thedailytechfeed.com/critical-apache-activemq-flaw-exposes-systems-to-malicious-http-header-injections-urgent-updates-advised/ #ApacheActiveMQ #CVE202642253 #Vulnerability #Exploit #XSS #Injection #Headers #HTTP #Security #Cybersecurity #Infosec #Patch #Upgrade #Mitigation #Exposure #Attack #Threat #Advisory #Software #Systems

    Post summary

    The post announces a critical CVE in Apache ActiveMQ, describes the injection-based vulnerability, and urges immediate patching to specific versions via an advisory link.

    0000038
    354 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-42253 CVE-2026-42253 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42253

    Post summary

    The brief post only lists the CVE identifier and a link to a vulnerability details page, with no additional context or technical information.

    0000046
    4.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheactivemq---
Appapacheactivemq_web---

Explore more

Back to dashboardapache CVEsactivemq vulnerabilities