CVE-2026-74761

medium Apache
Published: September 9, 2026 (1 days ago)
Last Modified: September 9, 2026
Vendor: Apache
Source: MITRE

Description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

CWE

CWE-20

Affected Products

Apache Software Foundation Apache ActiveMQ BrokerApache Software Foundation Apache ActiveMQ AllApache Software Foundation Apache ActiveMQ

References

🔗 lists.apache.org