PT-2025-43673 · Flashmq · Flashmq

Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-62723

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FlashMQ versions prior to 1.23.2

Description FlashMQ, a MQTT broker/server designed for multi-CPU environments, has an issue where authenticated users can create sessions that collect Quality of Service (QoS) messages. These messages are not released when sessions expire, leading to potential resource exhaustion.

Recommendations Update to version 1.23.2 or later.

Exploit

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2025-62723

GHSA-7MHP-22Q4-R6VV

Affected Products

Flashmq

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62723.json · Exploit
• https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9 · Patch
• https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62723 · Security Note
• https://github.com/halfgaar/FlashMQ/issues/154 · Note
• https://twitter.com/CVEnew/status/1981821935638941923 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981858173192491372 · Twitter Post
• https://t.me/CVEtracker/35716 · Telegram Post