CVE-2026-74761

Published: Sep 9, 2026Modified: Sep 18, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Affected (6)

Products: Apache: Activemq, Activemq All, Activemq Broker

3 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apache Activemq	version < 5.19.11
Apache Activemq	6.0.0 ≤ version < 6.3.2
Apache Activemq All	version < 5.19.11
Apache Activemq All	6.0.0 ≤ version < 6.3.2
Apache Activemq Broker	version < 5.19.11
Apache Activemq Broker	6.2.0 ≤ version < 6.3.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/09/08/12

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.