FlashMQ, a multi‑CPU MQTT broker, contains a flaw that allows an authorized client to write more data into the broker’s write buffer than the permitted over‑commit limit. The excess data triggers an unchecked internal exception (CWE‑248). Because the exception is not caught, the broker process aborts, immediately interrupting service for all connected clients. The primary impact is a denial of service that disrupts availability of the broker.

The vulnerability applies to FlashMQ version 1.26.1 and all earlier releases distributed by halfgaar. Version 1.26.2 contains the fix through a code commit that prevents the unchecked exception.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV. Based on the description, it is inferred that the attacker must be an authorized MQTT client that can reach the broker, requiring valid credentials or a compromised authentication flow. Once authenticated, the client can exceed write limits to force the server abort.