CVE-2026-50018
mediumHoverfly is an open source API simulation tool.
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/SpectoLabs/hoverfly/pull/1228 security-advisories@github.com
- https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8 security-advisories@github.com
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7 security-advisories@github.com
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7 134c704f-9b21-4f2e-91b3-4a467353bcc0