BIT-activemq-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Q: What access does an attacker need to exploit this issue?

The attacker must be an authenticated client. The issue allows that client to spoof a clientId while removing a durable topic subscription.

Q: Which deployments are affected?

Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ are affected on all platforms before 5.19.11, and from 6.0.0 before 6.3.2.

Q: What is the recommended remediation?

Upgrade to Apache ActiveMQ version 5.19.11 or 6.3.2, which fix the issue.

Published Sep 9, 2026

Updated

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

An authenticated client can spoof clientId when removing a durable topic subscription.

This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ All: before 5.19.11, from 6.0.0 before 6.3.2; Apache ActiveMQ: before 5.19.11, from 6.0.0 before 6.3.2.

Users are recommended to upgrade to version 6.3.2 or 5.19.11 which fixes the issue.

Affected Software

3 affected components

Apache ActiveMQ Broker<5.19.11, >=6.0.0<6.3.2

Apache ActiveMQ All<5.19.11, >=6.0.0<6.3.2

Apache ActiveMQ<5.19.11, >=6.0.0<6.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ActiveMQ Broker to a version that resolves this vulnerability.
Fixed in 6.3.2
Upgrade
Upgrade Apache ActiveMQ Broker to a version that resolves this vulnerability.
Fixed in 5.19.11
Upgrade
Upgrade Apache ActiveMQ All to a version that resolves this vulnerability.
Fixed in 6.3.2
Upgrade
Upgrade Apache ActiveMQ All to a version that resolves this vulnerability.
Fixed in 5.19.11
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.3.2
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 5.19.11

Event History

Sep 9, 2026

CVE Published

via OSV·11:10 AM

Data Sourced

via OSV·11:10 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be an authenticated client. The issue allows that client to spoof a clientId while removing a durable topic subscription.

Which deployments are affected?

Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ are affected on all platforms before 5.19.11, and from 6.0.0 before 6.3.2.

What is the recommended remediation?

Upgrade to Apache ActiveMQ version 5.19.11 or 6.3.2, which fix the issue.

BIT-activemq-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What is the recommended remediation?