CVE-2026-74761

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74761
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74761.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74761
Aliases
Downstream
Published
2026-09-09T11:10:16Z
Modified
2026-09-20T11:47:27Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Details

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

An authenticated client can spoof clientId when removing a durable topic subscription.

This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.

Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74761.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.3.2"
                },
                {
                    "fixed": "5.19.11"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.3.2"
                },
                {
                    "fixed": "5.19.11"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.3.2"
                },
                {
                    "fixed": "5.19.11"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.19.11"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.3.2"
                },
                {
                    "fixed": "5.19.11"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.3.2"
                },
                {
                    "fixed": "5.19.11"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.3.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type
GIT
Repo
https://github.com/apache/activemq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cd2f121c6af905e9a3522e6e30548f0ec60f0572
Introduced
14bac13f40958c1a1d3d198051eed32facc4abd1
Fixed
ea18a99e1f5943a446ea2862b9e3827e7f048257
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.11"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.3.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

activemq-5.*
activemq-5.10.0
activemq-5.11.0
activemq-5.12.0
activemq-5.13.0
activemq-5.14.0
activemq-5.15.0
activemq-5.16.0
activemq-5.18.0
activemq-5.18.1
activemq-5.18.2
activemq-5.18.3
activemq-5.18.4
activemq-5.18.5
activemq-5.18.6
activemq-5.19.0
activemq-5.19.1
activemq-5.19.2
activemq-5.9.0
activemq-6.*
activemq-6.0.0
activemq-6.1.0
activemq-6.1.1
activemq-6.1.2
activemq-6.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74761.json"