CVE-2026-74761

EUVD-2026-74829

09.09.2026, 12:17

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

An authenticated client can spoof clientId when removing a durable topic subscription.

This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.

Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	UNKNOWN				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	activemq_broker	6.0.0 ≤ 𝑥 < 6.3.2	CNA
apache	activemq_broker	𝑥 < 5.19.11	CNA

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Vulnerability Media Exposure

[GERMAN] Apache ActiveMQ: Schwachstelle ermöglicht DoS und Manipulation von Daten
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache ActiveMQ ausnutzen, um einen Denial of Service Angriff durchzuführen und Daten zu manipulieren.
Published: 2026-09-08T22:00:00+00:00

References

https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz

http://www.openwall.com/lists/oss-security/2026/09/08/12