Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-74761

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache ActiveMQ Broker

Default version status: unaffected

  • 6.0.0 to < 6.3.2affected
  • 0 to < 5.19.11affected

Apache Software Foundation Apache ActiveMQ All

Default version status: unaffected

  • 6.0.0 to < 6.3.2affected
  • 0 to < 5.19.11affected

Apache Software Foundation Apache ActiveMQ

Default version status: unaffected

  • 6.0.0 to < 6.3.2affected
  • 0 to < 5.19.11affected

References