CVE-2026-50018
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
MEDIUM 6.5EPSS 0.5%
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
- Affected
- SpectoLabs · hoverfly
- CVSS v3.1 GITHUB
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - EPSS
- 0.54% chance of exploitation in the next 30 days, 45th percentile
- Published
- 2026-09-11
- Updated
- 2026-09-14