PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42253 Apache Software Foundation CVE debrief

Apache ActiveMQ's MessageServlet copies all JMS message properties into HTTP response headers without validation, enabling header injection and security header manipulation. The vulnerability affects ActiveMQ before 5.19.7 and versions 6.0.0 through 6.2.5, as well as Apache ActiveMQ Web in the same ranges. The MessageServlet has been deprecated and disabled by default in the fixed versions.

Vendor
Apache Software Foundation
Product
Apache ActiveMQ
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running Apache ActiveMQ with the web console enabled, particularly those exposing MessageServlet endpoints to untrusted users or processing JMS messages from external sources.

Technical summary

The MessageServlet in Apache ActiveMQ's web console API iterates over JMS message properties and copies each into the HTTP response headers without sanitization or validation. This allows an attacker who can control JMS message properties to inject arbitrary HTTP response headers, including overwriting security headers such as Content-Security-Policy, X-Frame-Options, or Set-Cookie. The behavior constitutes improper neutralization of input during web page generation (CWE-79) and can facilitate cross-site scripting or response splitting attacks. The fix in versions 5.19.7 and 6.2.6 deprecates and disables the MessageServlet by default.

Defensive priority

high

Recommended defensive actions

  • Upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6 or later.
  • If immediate upgrade is not possible, disable or restrict access to the MessageServlet in the ActiveMQ web console.
  • Review HTTP response headers in ActiveMQ web console responses for unexpected or injected values.
  • Monitor JMS message properties for values resembling HTTP header names (e.g., 'Content-Type', 'Set-Cookie', 'X-Frame-Options').
  • Audit access logs for requests to MessageServlet endpoints that may indicate exploitation attempts.

Evidence notes

CVE published 2026-06-01. Advisory references confirm Apache security team disclosure. No KEV listing.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42253 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42253

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42253 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42253

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.