A heap-use-after-free vulnerability was identified in the Mosquitto MQTT broker during password file cleanup. The issue was discovered via OSS-Fuzz and involves a read operation on freed heap memory in the password_file__cleanup function. A fix for this vulnerability has been committed.