Read the docs
TI-2026-36844 Aliases CVE-2026-50018GHSA-42j2-w334-qxw7

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Priority MEDIUM 62CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Fix Fixed hoverfly (SpectoLabs): 1.12.8github.com/SpectoLabs/hoverfly (Go): 1.12.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SpectoLabshoverflybefore 1.12.81.12.8Patch availableCNA
—github.com/SpectoLabs/hoverfly (Go)before 1.12.81.12.8Patch availableGHSA-42j2-w334-qxw7
  • hoverfly VendorSpectoLabs Affected before 1.12.8 Fixed in 1.12.8 Patch available CNA
  • github.com/SpectoLabs/hoverfly (Go) Vendor— Affected before 1.12.8 Fixed in 1.12.8 Patch available GHSA-42j2-w334-qxw7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hoverfly:hoverfly:*:*:*:*:*:*:*:*——SpectoLabs
  • cpe:2.3:a:hoverfly:hoverfly:*:*:*:*:*:*:*:* Versions — — ·SpectoLabs

Remediation

  • Fix · CNA hoverfly (SpectoLabs) Fixed in 1.12.8
  • Fix · GHSA-42j2-w334-qxw7 github.com/SpectoLabs/hoverfly (Go) Fixed in 1.12.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50018
  2. 2026-10-03 Alias added: GHSA-42j2-w334-qxw7

References

Other 4

  • TI-2025-33966 Improper input validation in SpectoLabs hoverfly CVSS 3.1CRITICAL 9.8
  • TI-2025-34185 Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled. CVSS 4.0HIGH 7.8
  • TI-2024-30437 Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`) CVSS 3.1HIGH 7.5
  • TI-2026-36839 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences