CVE-2026-50013

Received Received - Intake

Race Condition in Hoverfly API Simulation Tool

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-50013

Affected Vendors & Products

Vendor	Product	Version / Range
hoverfly	hoverfly	to 1.12.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-820	The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in Hoverfly, an API simulation tool. When running in Diff mode, the AddDiff function writes to a shared map without synchronization. Concurrent requests cause a race condition, triggering Go's race detector and crashing the entire Hoverfly process.

Detection Guidance

This vulnerability can be detected by monitoring for crashes in Hoverfly when running in Diff mode with concurrent requests. Check logs for 'fatal error: concurrent map read and map write' messages. Ensure Hoverfly version is below 1.12.8.

Impact Analysis

The vulnerability allows attackers to send multiple simultaneous requests to crash the Hoverfly service, causing denial of service. This disrupts API simulation and testing workflows relying on Hoverfly.

Compliance Impact

This vulnerability causes a fatal error in Hoverfly, terminating the process unexpectedly. This could lead to service unavailability or data processing interruptions, potentially violating availability requirements in GDPR and HIPAA.

Mitigation Strategies

Upgrade Hoverfly to version 1.12.8 or later immediately. Avoid using Diff mode until updated. If Diff mode is required, limit concurrent requests to reduce race conditions.

Hi! I’m here to help you understand CVE-2026-50013. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70