7.5Alta
CVE-2026-74761Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Descripción
Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.
Debilidad (CWE):
CWE-20
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| apache | activemq | < 5.19.11 | |
| apache | activemq all | < 5.19.11 | |
| apache | activemq broker | < 5.19.11 | |
| Apache Software Foundation | Apache ActiveMQ | 6.0.0 – < 6.3.2, < 5.19.11 | |
| Apache Software Foundation | Apache ActiveMQ All | 6.0.0 – < 6.3.2, < 5.19.11 | |
| Apache Software Foundation | Apache ActiveMQ Broker | 6.0.0 – < 6.3.2, < 5.19.11 |
Referencias y parches
- https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/09/08/12 Mailing List
Coincidencias CPE (NVD) (6)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*< 5.19.11cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.3.2cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:*< 5.19.11cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.3.2cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*< 5.19.11cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*≥ 6.2.0 < 6.3.2