{"id":"EUVD-2026-76755","enisaUuid":"589fe31d-5588-3fb4-b058-540c158e2e2e","description":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go\u0027s built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.","datePublished":"Sep 11, 2026, 9:27:40 PM","dateUpdated":"Sep 14, 2026, 6:17:21 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg\nhttps://github.com/SpectoLabs/hoverfly/pull/1227\nhttps://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8\n","aliases":"CVE-2026-50013\nGHSA-qrh4-p6v4-mrfg\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"a9817049-54b1-33b9-b4a2-cf5abd6f73f7","product":{"name":"hoverfly","vendor":{"name":"SpectoLabs"}},"product_version":"\u003c 1.12.8"}],"enisaIdVendor":[{"id":"387c8f00-58fd-37ca-81d0-1a30e4a27034","vendor":{"name":"SpectoLabs"}}],"enisaIdVulnerability":[{"id":"007c6dbe-6612-37c9-890b-05f1572120a3","vulnerability":{"id":"GHSA-qrh4-p6v4-mrfg","description":"Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode","datePublished":"Jul 14, 2026, 6:03:10 PM","dateUpdated":"Jul 14, 2026, 6:03:10 PM","baseScore":0.0,"references":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg\nhttps://github.com/SpectoLabs/hoverfly/pull/1227\nhttps://github.com/SpectoLabs/hoverfly\nhttps://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8\n","enisa_id":"EUVD-2026-76755\n","aliases":"GHSA-qrh4-p6v4-mrfg\nCVE-2026-50013\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"efbd56dc-3573-31a8-9444-95ce45e74fb4","vulnerability":{"id":"CVE-2026-50013","description":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go\u0027s built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.","datePublished":"Sep 11, 2026, 9:27:40 PM","dateUpdated":"Sep 14, 2026, 6:17:21 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg\nhttps://github.com/SpectoLabs/hoverfly/pull/1227\nhttps://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8\n","enisa_id":"EUVD-2026-76755\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 1, 2026, 7:16:18 AM","vulnerabilityProduct":[{"id":"0849c095-8037-336b-8aa7-eea5081ed9a2","product":{"name":"hoverfly","vendor":{"name":"SpectoLabs"}},"product_version":"\u003c 1.12.8"}],"vulnerabilityVendor":[{"id":"c155f3db-7b18-371e-923f-fd1281ea6968","vendor":{"name":"SpectoLabs"}}]}}],"enisaIdAdvisory":[]}