CVE-2026-50013

HighCVSS 7.5

Published: 11/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff() function writes to the shared responsesDiff map without any synchronization (no mutex). When multiple proxy requests are processed concurrently, the concurrent map writes trigger Go's built-in race detector which causes a fatal error: concurrent map read and map write, immediately killing the entire Hoverfly process.

Risk Assessment

The vulnerability is trivially exploitable by sending multiple simultaneous requests, leading to denial of service (DoS). Any Hoverfly deployment in Diff mode is affected.

Recommendation

Update Hoverfly to version 1.12.8 or later, which contains the patch. Until the update, consider limiting concurrent requests or disabling Diff mode.

Other vulnerabilities in Hoverfly

CVE-2026-50018Medium
Hoverfly prior to version 1.12.8 uses http.DefaultClient without any timeout configuration for remote post-serve actions. When the remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do().

Original NVD description (English source)

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS