CVE-2026-50018: CWE-400: Uncontrolled Resource Consumption in SpectoLabs hoverfly
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
AI Analysis
Technical Summary
Hoverfly versions before 1.12.8 use the default HTTP client without timeout settings for remote post-serve actions. If the remote endpoint is unreachable or intentionally slow, each proxy request spawns a goroutine that blocks indefinitely on the HTTP request, causing uncontrolled resource consumption. This can lead to memory exhaustion and process termination due to out-of-memory conditions. The vulnerability requires no binary execution, only a URL to a non-responsive endpoint. Version 1.12.8 includes a patch that addresses this issue.
Potential Impact
An attacker can cause denial of service by triggering many proxy requests to non-responsive endpoints, resulting in unbounded goroutine accumulation and memory exhaustion. This can crash the hoverfly process due to out-of-memory kills, impacting availability.
Mitigation Recommendations
Upgrade to SpectoLabs hoverfly version 1.12.8 or later, where this issue is patched. No other mitigation is required as the fix addresses the root cause by adding timeout configuration to the HTTP client.
CVE-2026-50018: CWE-400: Uncontrolled Resource Consumption in SpectoLabs hoverfly
Description
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
CVSS v3.1
Score 6.5medium
Affected software
SpectoLabs
hoverfly
pkg:golang/github.com/spectolabs/hoverflyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Hoverfly versions before 1.12.8 use the default HTTP client without timeout settings for remote post-serve actions. If the remote endpoint is unreachable or intentionally slow, each proxy request spawns a goroutine that blocks indefinitely on the HTTP request, causing uncontrolled resource consumption. This can lead to memory exhaustion and process termination due to out-of-memory conditions. The vulnerability requires no binary execution, only a URL to a non-responsive endpoint. Version 1.12.8 includes a patch that addresses this issue.
Potential Impact
An attacker can cause denial of service by triggering many proxy requests to non-responsive endpoints, resulting in unbounded goroutine accumulation and memory exhaustion. This can crash the hoverfly process due to out-of-memory kills, impacting availability.
Mitigation Recommendations
Upgrade to SpectoLabs hoverfly version 1.12.8 or later, where this issue is patched. No other mitigation is required as the fix addresses the root cause by adding timeout configuration to the HTTP client.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-02T22:46:02.579Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa4737691cc7f3848ae20c3
Added to database: 09/11/2026, 21:32:38 UTC
Last enriched: 09/11/2026, 21:47:48 UTC
Last updated: 09/11/2026, 22:23:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.