CVE-2026-74761

Description

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2. Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Traduire en français

Produits concernés

• Apache Software Foundation Apache ActiveMQ Broker
• Apache Software Foundation Apache ActiveMQ All
• Apache Software Foundation Apache ActiveMQ
• Apache activemq
• Apache activemq all
• Apache activemq broker

Scores CVSS

Faiblesses (CWE)

• CWE-20

Références

• https://lists.apache.org/thread/n9md06jo7ccqmj2mntx4kpcl2d5xqntz Mailing ListVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/09/08/12 Mailing List

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories