CVE-2026-50018

Summary

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do(). An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Affected Software

VendorProductVersion RangeStatus
SpectoLabshoverfly< 1.12.8affected

Weaknesses

  • CWE-400: CWE-400: Uncontrolled Resource Consumption
  • CWE-770: CWE-770: Allocation of Resources Without Limits or Throttling

References