CVE-2026-42253 is a CWE-79 cross-site scripting vulnerability in Apache ActiveMQ's web console API. The MessageServlet copies all JMS message properties directly into HTTP response headers without validation, enabling attackers to inject or overwrite security headers by crafting malicious JMS messages. This vulnerability affects Apache ActiveMQ versions prior to 5.19.7 and versions from 6.0.0 up to but not including 6.2.6. The issue is addressed by deprecating and disabling the MessageServlet by default and releasing fixed versions 5.19.7 and 6.2.6.

An attacker able to send JMS messages that are processed by the vulnerable MessageServlet can inject or overwrite HTTP response headers, potentially leading to cross-site scripting attacks or manipulation of security headers. This can result in limited confidentiality and integrity impacts in affected deployments. The vulnerability does not affect availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

A fix is available by upgrading Apache ActiveMQ to version 5.19.7 or 6.2.6 or later. These versions deprecate and disable the vulnerable MessageServlet by default, eliminating the attack vector. Users should apply these official updates promptly. No additional mitigations are specified or required once the upgrade is applied.