FlashMQ
CVE-2025-62723
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-facing broker but valid credentials are required (PR:L); only a slow memory leak with no data exposure, so C:N/I:N and limited availability impact (A:L).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.
AnalysisAI
Authenticated users of FlashMQ MQTT brokers running versions prior to 1.23.2 can cause a gradual memory leak by creating sessions that accumulate QoS messages which are never delivered to a connected client; the queued publish entries are not released even after the session eventually expires. The result is slow, cumulative memory growth that can degrade broker stability over time rather than an immediate crash (CVSS 4.3, A:L), and exploitation requires valid credentials (PR:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; EPSS is low at 0.34% (25th percentile), and the vendor has released a fix in 1.23.2.
Technical ContextAI
FlashMQ is a high-performance MQTT broker/server designed for multi-CPU environments, and the flaw resides in its internal QoS publish queue management. The root cause is CWE-772 (Missing Release of Resource after Effective Lifetime): the QueuedPublish linked list in qospacketqueue.cpp/h used std::shared_ptr for its prev/next pointers, creating strong reference cycles that prevented queued QoS publish entries from being freed when a session expired without those messages ever being delivered to a client. The upstream fix (commit e86c49360ef4387440c97f591770cdb9284b4ee9) converts the prev/next members from std::shared_ptr to std::weak_ptr, deletes the copy/move assignment operators on QueuedPublish, and updates traversal sites in session.cpp and sessionsandsubscriptionsdb.cpp to use .lock() when dereferencing the weak references. This breaks the reference cycle so queue nodes are reclaimed on session expiry. The affected component is the MQTT session/QoS delivery subsystem; the CPE cpe:2.3:a:flashmq:flashmq:*:*:*:*:*:*:*:* denotes all FlashMQ versions prior to the patched release.
RemediationAI
Upgrade FlashMQ to version 1.23.2, which fully remediates the issue; the fix is contained in commit e86c49360ef4387440c97f591770cdb9284b4ee9 and described in advisory GHSA-7mhp-22q4-r6vv. Vendor patch status is 'available from vendor'. Where upgrading immediately is not possible, compensating controls trade off functionality or operations: restrict broker accounts so only fully trusted, authenticated clients can create sessions and subscriptions, since exploitation requires credentials (PR:L); monitor broker process memory (RSS) for unbounded growth tied to expired sessions and schedule periodic broker restarts to reclaim leaked memory-restarts briefly interrupt all connected clients and do not fix the underlying leak; and reduce session expiry intervals or cap per-session queued QoS message volume where the broker supports such limits, accepting that aggressive expiry shortens offline-message retention for legitimate clients. None of these controls is a substitute for upgrading to 1.23.2.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messa
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 throu
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing w
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client
Loopback source-address restriction bypass in RabbitMQ's native MQTT and MQTT-over-WebSocket listeners (all releases fro
Authorization bypass in RabbitMQ's MQTT topic permission handling allows a low-privileged authenticated user to broaden
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PU
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today