Session Management Vulnerability in FlashMQ MQTT Broker

CVE-2025-62723

What is CVE-2025-62723?

FlashMQ, an MQTT broker/server designed for multi-CPU environments, contains a session management vulnerability that allows authenticated users to create sessions that can collect Quality of Service (QoS) messages. If these messages are not sent to a client, they remain unreleased even after the session expires, leading to potential resource exhaustion and exposure of sensitive information. The issue was resolved in version 1.23.2, highlighting the importance of promptly updating to mitigate related risks.

References