CVE-2025-62723

FlashMQ does not release memory of queued QoS messages

State: Published
Severity: 4.3 Medium
Published: Oct 24, 2025
Updated: Oct 24, 2025
Reserved: Oct 20, 2025

Description

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

Product	Versions
FlashMQhalfgaar	< 1.23.2Affected

References

https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv
https://github.com/halfgaar/FlashMQ/issues/154
https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.