What’s Vulnerable › Vulnerabilities

CVE-2026-50013: Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-11 · updated 2026-09-30
• Weakness: CWE-362

Description

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

Affected products

• SpectoLabs hoverfly: before 1.12.8

References

• https://github.com/SpectoLabs/hoverfly/pull/1227
• https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg

Get alerted when CVE-2026-50013 or the next vulnerability affects your stack