CVE-2026-42253

Overview

Apache ActiveMQ is a popular open-source, multi-protocol message broker written in Java. It supports JMS 1.1 messaging along with OpenWire, AMQP, STOMP, and MQTT clients, and ships a web console and REST API hosted on an embedded Jetty server. Broker, client, and web components are published as Maven artifacts under org.apache.activemq.

A cross-site scripting (XSS) vulnerability (CVE-2026-42253) has been identified in the MessageServlet of the ActiveMQ web console REST API, which allows attackers to inject or overwrite HTTP response headers, including security headers, by setting crafted properties on JMS messages that the servlet later returns.

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

This issue affects multiple versions of ActiveMQ.

‍

Details

Module Info

• Product: ActiveMQ
• Affected packages: org.apache.activemq:activemq-web, org.apache.activemq:apache-activemq
• Affected versions:
  • org.apache.activemq:activemq-web: <5.19.7, >=6.0.0 <6.2.6
  • org.apache.activemq:apache-activemq: <5.19.7, >=6.0.0 <6.2.6
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-web, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS ActiveMQ 5.19.7, 6.2.6
  • NES for ActiveMQ v5.16.10

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:activemq-web package in multiple versions of ActiveMQ. The MessageServlet class backs the /api/message/* endpoint of the web console's REST API, which the apache-activemq distribution enables by default in its api web application. When an HTTP client reads a message from a queue or topic through this endpoint, the servlet's writeResponse method passes the consumed JMS message to setResponseHeaders, which turns every JMS message property into an HTTP response header:

protected void setResponseHeaders(HttpServletResponse response, Message message) throws JMSException {
    response.setHeader("destination", message.getJMSDestination().toString());
    response.setHeader("id", message.getJMSMessageID());

    // Return JMS properties as header values.
    for (Enumeration names = message.getPropertyNames(); names.hasMoreElements(); ) {
        String name = (String) names.nextElement();
        response.setHeader(name, message.getObjectProperty(name).toString());
    }
}

Neither the property name nor its value is checked. Any party able to publish a message to a destination, for example over OpenWire, STOMP, AMQP, or MQTT, controls the header names and values that the web console returns to whoever later reads that message over HTTP. Because setResponseHeaders runs after the servlet has set its own headers, a property with the same name, such as Content-Type, overwrites them, and properties such as Content-Security-Policy, X-Frame-Options, or Set-Cookie inject new security-relevant headers into the response. An attacker can use this to change how a browser interprets the attacker-controlled message body or to weaken the protections that would otherwise apply to it, exposing users of the web console origin to cross-site scripting.

‍

Mitigation

Only recent versions of Apache ActiveMQ are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade ActiveMQ to a currently supported release that contains the fix, such as 5.19.7.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Vishal Shukla (finder)
• pyn3rd (finder)
• uname (finder)
• 4ra1n (finder)
• kikayli (finder)