CVE-2026-50018

Description

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Traduire en français

Produits concernés

• SpectoLabs hoverfly

Scores CVSS

Faiblesses (CWE)

• CWE-400
• CWE-770

Références

• https://github.com/SpectoLabs/hoverfly/pull/1228
• https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories