CVE-2026-41043
Full vulnerability record from the local CVENow database.
Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-24 11:16:22.670000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-41043",
"sourceIdentifier": "[email protected]",
"published": "2026-04-24T11:16:22.670",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nAn authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue."
},
{
"lang": "es",
"value": "Vulnerabilidad de Neutralización Incorrecta de Etiquetas HTML Relacionadas con Scripts en una Página Web (XSS Básico) en Apache ActiveMQ, Apache ActiveMQ Web.\n\nUn atacante autenticado puede mostrar contenido malicioso al navegar por las colas en la consola web al anular el tipo de contenido para que sea HTML (en lugar de XML) y al inyectar HTML en un campo selector JMS.\n\nEste problema afecta a Apache ActiveMQ: anterior a 5.19.6, desde 6.0.0 anterior a 6.2.5; Apache ActiveMQ Web: anterior a 5.19.6, desde 6.0.0 anterior a 6.2.5.\n\nSe recomienda a los usuarios actualizar a la versión 6.2.5 o 5.19.6, que corrige el problema."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache ActiveMQ",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.activemq:apache-activemq",
"versions": [
{
"version": "0",
"lessThan": "5.19.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.0.0",
"lessThan": "6.2.5",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Apache Software Foundation",
"product": "Apache ActiveMQ Web",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.activemq:activemq-web",
"versions": [
{
"version": "0",
"lessThan": "5.19.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.0.0",
"lessThan": "6.2.5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-24T18:05:08.864867Z",
"id": "CVE-2026-41043",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-915"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.6",
"matchCriteriaId": "550C287A-18F0-462A-BFC9-2AD8A64B951A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.2.5",
"matchCriteriaId": "F7BDD719-DDF9-42A2-AD9D-05FB6D758EF1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.6",
"matchCriteriaId": "6D85C151-239D-408F-833F-9DEB4341EC19"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.2.5",
"matchCriteriaId": "D0D5129B-51AC-4A0D-B4A4-17D84A9D89CE"
}
]
}
]
}
],
"references": [
{
"url": "https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/23/5",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
]
}
]
}