4.3

CVE-2025-62723

EPSS 0.07%
Veröffentlicht 24.10.2025 20:16:34
Zuletzt bearbeitet 31.10.2025 19:31:48
Quelle security-advisories@github.com
CVE-Watchlists
Login
Unerledigt
Login

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Flashmq ≫ Flashmq Version < 1.23.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.07%	0.212

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
security-advisories@github.com	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-772 Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv

Patch

Vendor Advisory

https://github.com/halfgaar/FlashMQ/issues/154

Issue Tracking

https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9

Patch

https://nvd.nist.gov/vuln/detail/CVE-2025-62723

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-62723

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-62723

EUVD