Medium severity4.3NVD Advisory· Published Oct 24, 2025· Updated Jun 17, 2026

CVE-2025-62723

Description

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FlashMQ/FlashMQ
cpe:2.3:a:flashmq:flashmq:*:*:*:*:*:*:*:*
Range: <1.23.2
Halfgaar/Flashmqllm-fuzzy2 versions
<1.23.2+ 1 more
- (no CPE)range: <1.23.2
- (no CPE)range: < 1.23.2

Patches

Vulnerability mechanics

References

github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9nvdPatch
github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vvnvdPatchVendor Advisory
github.com/halfgaar/FlashMQ/issues/154nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000