{"id":"EUVD-2026-76754","revision":"9e745e2ac64c4e948c186972bd3cf7b6","records":[{"revision":"9e745e2ac64c4e948c186972bd3cf7b6","observedAt":"2026-10-30T08:53:47.032+00:00","statement":{"source":"euvd","id":"EUVD-2026-76754","aliases":["CVE-2026-50018","GHSA-42j2-w334-qxw7"],"title":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connec…","description":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":null}],"references":["https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7","https://github.com/SpectoLabs/hoverfly/pull/1228","https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76754","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 11, 2026, 9:28:29 PM","dateUpdated":"Sep 14, 2026, 7:28:30 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-76754","identifiers":["EUVD-2026-76754","CVE-2026-50018","GHSA-42j2-w334-qxw7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}