CVE-2025-62723CWE-772

CVE-2025-62723

Medium · published October 25, 2025

CVSS v3.1

4.3

EPSS

Percentile

26.3

In the wild

Unconfirmed

What it is

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00341 · 26.3th percentile
Weakness: CWE-772 · Missing Release of Resource after Effective Lifetime
Published: 2025-10-25T01:16Z

Affected products (1)

Product	Versions	Fixed in
flashmq/flashmq	< 1.23.2	1.23.2

References (3)

https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9 · [email protected]https://github.com/halfgaar/FlashMQ/issues/154 · [email protected]https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv · [email protected]

EPSS history

Timeline

24 OCT 20:16Z
FlashMQ does not release memory of queued QoS messages
cvelistv5