7.5High
CVE-2026-74761Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Description
Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.
Weakness (CWE):
CWE-20
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| apache | activemq | < 5.19.11 | |
| apache | activemq all | < 5.19.11 | |
| apache | activemq broker | < 5.19.11 | |
| Apache Software Foundation | Apache ActiveMQ | 6.0.0 – < 6.3.2, < 5.19.11 | |
| Apache Software Foundation | Apache ActiveMQ All | 6.0.0 – < 6.3.2, < 5.19.11 | |
| Apache Software Foundation | Apache ActiveMQ Broker | 6.0.0 – < 6.3.2, < 5.19.11 |
References and patches
- https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/09/08/12 Mailing List
CPE matches (NVD) (6)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*< 5.19.11cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.3.2cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:*< 5.19.11cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.3.2cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*< 5.19.11cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*≥ 6.2.0 < 6.3.2