What’s Vulnerable › Vulnerabilities

CVE-2026-50018: Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-11 · updated 2026-09-30
• Weakness: CWE-400

Description

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Affected products

• SpectoLabs hoverfly: before 1.12.8

References

• https://github.com/SpectoLabs/hoverfly/pull/1228
• https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7

Get alerted when CVE-2026-50018 or the next vulnerability affects your stack