CVE-2026-50013— Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Quick assessment
Affected
SpectoLabs hoverfly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： Hoverfly 是一款开源的 API 模拟工具。在 1.12.8 版本之前，当 Hoverfly 以 Diff（差异对比）模式运行时， 函数在向共享的 映射写入数据时没有进行任何同步（未使用互斥锁/mutex）。当多个代理请求被并发处理时（这是代理服务器的典型工作场景），并发的映射写入操作会触发 Go 语言内置的竞态检测器，导致出现 （致命错误：映射的并发读与写冲突），从而立即终止整个 Hoverfly 进程。攻击者只需发送多个并发的请求即可轻松触发此问题。该问题已在 1.12.8
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1027 · Obfuscated Files or Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Source: CVE Program / CVE List V5
Vulnerability Description
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SpectoLabs | hoverfly | < 1.12.8 | - |
|
II. Public POCs for CVE-2026-50013
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50013
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-50013 (1)
Vendor Advisories for CVE-2026-50013 (1)
Vendor Pages for CVE-2026-50013 (1)
-
🔗 Release v1.12.8 · SpectoLabs/hoverfly · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: hoverfly
-
CVE-2026-50018
Hoverfly: Denial of Service via Goroutine Leak in Remote Pos -
CVE-2025-54376
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable wi -
CVE-2025-54123
Hoverfly vulnerable to remote code execution at `/api/v2/hov -
CVE-2024-45388
Arbitrary file read in the `/api/v2/simulation` endpoint in
Same vendor: SpectoLabs
-
CVE-2026-50018
Hoverfly: Denial of Service via Goroutine Leak in Remote Pos -
CVE-2025-54376
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable wi -
CVE-2025-54123
Hoverfly vulnerable to remote code execution at `/api/v2/hov -
CVE-2024-45388
Arbitrary file read in the `/api/v2/simulation` endpoint in
Same weakness: CWE-362
-
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads -
CVE-2026-86766
Snipe-IT 8.6.3 Race Condition via Consumable Checkout -
CVE-2026-86744
snipe-it before 8.7.0 Race Condition in Asset Checkout -
CVE-2026-87816
PasswordPusher before 2.11.1 Race Condition View Limit Bypas -
CVE-2026-87601
Google Chrome 竞争条件问题漏洞
V. Comments for CVE-2026-50013
No comments yet