CVE-2026-41043

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/23/5	Mailing List

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:activemq::::::::
	cpe:2.3:a:apache:activemq::::::::
	cpe:2.3:a:apache:activemq_web::::::::
	cpe:2.3:a:apache:activemq_web::::::::

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Neutralización Incorrecta de Etiquetas HTML Relacionadas con Scripts en una Página Web (XSS Básico) en Apache ActiveMQ, Apache ActiveMQ Web. Un atacante autenticado puede mostrar contenido malicioso al navegar por las colas en la consola web al anular el tipo de contenido para que sea HTML (en lugar de XML) y al inyectar HTML en un campo selector JMS. Este problema afecta a Apache ActiveMQ: anterior a 5.19.6, desde 6.0.0 anterior a 6.2.5; Apache ActiveMQ Web: anterior a 5.19.6, desde 6.0.0 anterior a 6.2.5. Se recomienda a los usuarios actualizar a la versión 6.2.5 o 5.19.6, que corrige el problema.

Information

Published : 2026-04-24 11:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-41043

Mitre link : CVE-2026-41043

CVE.ORG link : CVE-2026-41043

JSON object : View

Products Affected

apache

activemq_web
activemq

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-41043", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41043", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T18:05:08.864867Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ", "versions": [{"status": "affected", "version": "0", "lessThan": "5.19.6", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.2.5", "versionType": "semver"}], "packageName": "org.apache.activemq:apache-activemq", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Web", "versions": [{"status": "affected", "version": "0", "lessThan": "5.19.6", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.2.5", "versionType": "semver"}], "packageName": "org.apache.activemq:activemq-web", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-04-24T11:16:22.670", "references": [{"url": "https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/23/5", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-915"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nAn authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Etiquetas HTML Relacionadas con Scripts en una P\u00e1gina Web (XSS B\u00e1sico) en Apache ActiveMQ, Apache ActiveMQ Web.\n\nUn atacante autenticado puede mostrar contenido malicioso al navegar por las colas en la consola web al anular el tipo de contenido para que sea HTML (en lugar de XML) y al inyectar HTML en un campo selector JMS.\n\nEste problema afecta a Apache ActiveMQ: anterior a 5.19.6, desde 6.0.0 anterior a 6.2.5; Apache ActiveMQ Web: anterior a 5.19.6, desde 6.0.0 anterior a 6.2.5.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 6.2.5 o 5.19.6, que corrige el problema."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "550C287A-18F0-462A-BFC9-2AD8A64B951A", "versionEndExcluding": "5.19.6"}, {"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7BDD719-DDF9-42A2-AD9D-05FB6D758EF1", "versionEndExcluding": "6.2.5", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D85C151-239D-408F-833F-9DEB4341EC19", "versionEndExcluding": "5.19.6"}, {"criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0D5129B-51AC-4A0D-B4A4-17D84A9D89CE", "versionEndExcluding": "6.2.5", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}