CVE-2026-50018— Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Quick assessment
Affected
SpectoLabs hoverfly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： Hoverfly 是一款开源的 API 模拟工具。在 1.12.8 版本之前，远程 post-serve 动作使用 且未配置任何超时机制。当远程端点不可达或故意响应缓慢（接受 TCP 连接但始终不返回响应）时，每个触发的代理请求都会生成一个在 上无限期阻塞的 goroutine。攻击者可以借此导致 goroutine 无限累积，最终引发内存耗尽和进程崩溃（OOM kill）。与本地 post-serve 动作的执行不同，该漏洞不需要执行二进制文件，只需提供一个指向无响应端点的 URL
Possible ATT&CK Techniques 1 AI
T1007 · System Service Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50018
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Source: CVE Program / CVE List V5
Vulnerability Description
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SpectoLabs | hoverfly | < 1.12.8 | - |
|
II. Public POCs for CVE-2026-50018
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50018
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-50018 (1)
Vendor Advisories for CVE-2026-50018 (1)
Vendor Pages for CVE-2026-50018 (1)
-
🔗 Release v1.12.8 · SpectoLabs/hoverfly · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: hoverfly
-
CVE-2026-50013
Hoverfly: Process Crash via Concurrent Map Write Race Condit -
CVE-2025-54376
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable wi -
CVE-2025-54123
Hoverfly vulnerable to remote code execution at `/api/v2/hov -
CVE-2024-45388
Arbitrary file read in the `/api/v2/simulation` endpoint in
Same vendor: SpectoLabs
-
CVE-2026-50013
Hoverfly: Process Crash via Concurrent Map Write Race Condit -
CVE-2025-54376
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable wi -
CVE-2025-54123
Hoverfly vulnerable to remote code execution at `/api/v2/hov -
CVE-2024-45388
Arbitrary file read in the `/api/v2/simulation` endpoint in
Same weakness: CWE-400
-
CVE-2026-90554
vLLM before 0.28.0 Denial of Service via audio extraction -
CVE-2026-54135
AirSane has a Remote Denial of Service (OOM) via Unvalidated -
CVE-2026-68497
jackson-databind: unbounded numeric parse in Duration and XM -
CVE-2026-87908
multiparty vulnerable to Denial of Service via unbounded par -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour
V. Comments for CVE-2026-50018
No comments yet