CVE-2026-50018

MediumCVSS 6.5

Published: 11/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

43th percentile - higher than 43% of all known CVEs

Summary

Hoverfly prior to version 1.12.8 uses http.DefaultClient without any timeout configuration for remote post-serve actions. When the remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do().

Risk Assessment

An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). This requires only a URL pointing to a non-responsive endpoint.

Recommendation

Update Hoverfly to version 1.12.8, which patches the issue.

Other vulnerabilities in Hoverfly

CVE-2026-50013High
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff() function writes to the shared responsesDiff map without any synchronization (no mutex). When multiple proxy requests are processed concurrently, the concurrent map writes trigger Go's built-in race detector which causes a fatal error: concurrent map read and map write, immediately killing the entire Hoverfly process.

Original NVD description (English source)

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS