CVE-2025-62723: flashmq

csirt@kutim:~/threat-intel/cve/CVE-2025-62723

CVSS 4.3 · Medium EPSS 0,34%

Kerentanan Missing Release of Resource after Effective Lifetime pada flashmq. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

Rincian

Terbit di NVD: 24 Oktober 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-772: Missing Release of Resource after Effective Lifetime
EPSS (30 hari): 0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
flashmq	flashmq	Semua versi sebelum 1.23.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv patch · advisory vendor
https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9 patch
https://github.com/halfgaar/FlashMQ/issues/154 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 00:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.