CVE-2025-62723: FlashMQ does not release memory of queued QoS messages

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-24 · updated 2026-10-08
Weakness: CWE-772

Description

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

Affected products

halfgaar FlashMQ: before 1.23.2 — fixed in 1.23.2

How to fix

Upgrade to a fixed version: halfgaar FlashMQ 1.23.2. Check the vendor advisory for mitigations.

References

https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9
https://github.com/halfgaar/FlashMQ/issues/154
https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv

Get alerted when CVE-2025-62723 or the next vulnerability affects your stack