Remote Execution Flaw in Hoverfly Open Source API Simulation Tool

CVE-2026-50018

What is CVE-2026-50018?

Hoverfly, an open-source API simulation tool, is vulnerable to an issue where remote post-serve actions can be exploited. Versions prior to 1.12.8 utilize http.DefaultClient without timeout configuration. This can allow an attacker to target a non-responsive endpoint. Each triggered proxy request generates a goroutine that can block indefinitely, leading to an unbounded accumulation of goroutines. This situation can result in memory exhaustion and ultimately crash the process due to an Out Of Memory (OOM) condition. The vulnerability is mitigated in version 1.12.8, which introduces the necessary timeout configurations.

References