CVE-2026-74761

EUVD-2026-74829

09.09.2026, 12:17

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

An authenticated client can spoof clientId when removing a durable topic subscription.

This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.

Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 49.28%

Affected Products (NVD)

Vendor	Product	Version
apache	activemq	𝑥 < 5.19.11
apache	activemq	6.0.0 ≤ 𝑥 < 6.3.2
apache	activemq_all	𝑥 < 5.19.11
apache	activemq_all	6.0.0 ≤ 𝑥 < 6.3.2
apache	activemq_broker	𝑥 < 5.19.11
apache	activemq_broker	6.2.0 ≤ 𝑥 < 6.3.2

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

activemq

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz

http://www.openwall.com/lists/oss-security/2026/09/08/12