{"id":"EUVD-2026-76754","enisaUuid":"3ec5a8d3-6d9e-3393-996f-316fe2d8637a","description":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.","datePublished":"Sep 11, 2026, 9:28:29 PM","dateUpdated":"Sep 14, 2026, 7:28:30 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7\nhttps://github.com/SpectoLabs/hoverfly/pull/1228\nhttps://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8\n","aliases":"CVE-2026-50018\nGHSA-42j2-w334-qxw7\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"76be9309-f416-32d1-912e-0d5515abdedf","product":{"name":"hoverfly","vendor":{"name":"SpectoLabs"}},"product_version":"\u003c 1.12.8"}],"enisaIdVendor":[{"id":"574dc7e6-9e86-379d-87ff-650a45780654","vendor":{"name":"SpectoLabs"}}],"enisaIdVulnerability":[{"id":"2c3cec6e-47ff-3a4e-a9af-0a569bcbfb74","vulnerability":{"id":"CVE-2026-50018","description":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.","datePublished":"Sep 11, 2026, 9:28:29 PM","dateUpdated":"Sep 14, 2026, 7:28:30 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7\nhttps://github.com/SpectoLabs/hoverfly/pull/1228\nhttps://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8\n","enisa_id":"EUVD-2026-76754\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Oct 30, 2026, 7:15:41 AM","vulnerabilityProduct":[{"id":"2c8b7747-5645-3d81-989d-18aeb4bdb26b","product":{"name":"hoverfly","vendor":{"name":"SpectoLabs"}},"product_version":"\u003c 1.12.8"}],"vulnerabilityVendor":[{"id":"fc5b6b2c-6173-32a4-b00b-aac4debfb281","vendor":{"name":"SpectoLabs"}}]}},{"id":"4ad04433-0a40-31ab-9cf9-55b65117e3eb","vulnerability":{"id":"GHSA-42j2-w334-qxw7","description":"Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions","datePublished":"Jul 14, 2026, 6:04:55 PM","dateUpdated":"Jul 14, 2026, 6:04:55 PM","baseScore":0.0,"references":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7\nhttps://github.com/SpectoLabs/hoverfly/pull/1228\nhttps://github.com/SpectoLabs/hoverfly\nhttps://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8\n","enisa_id":"EUVD-2026-76754\n","aliases":"CVE-2026-50018\nGHSA-42j2-w334-qxw7\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}