CVE-2026-50018

Deferred Deferred - Pending Action

Remote Post-Serve Action Timeout Bypass in Hoverfly

Publication date: 2026-09-11

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-30

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-50018

Affected Vendors & Products

Vendor	Product	Version / Range
hoverfly	hoverfly	to 1.12.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Hoverfly before version 1.12.8 has a flaw where remote post-serve actions use an HTTP client without timeout settings. If the remote endpoint is slow or unresponsive, each proxy request creates a blocking goroutine that never completes, leading to memory exhaustion and crashes.

Detection Guidance

Check for excessive goroutines or memory usage in Hoverfly processes. Monitor network connections to unexpected remote endpoints configured in post-serve actions. Use system tools like 'ps' or 'top' to observe Hoverfly process behavior under load.

Impact Analysis

An attacker could trigger this by sending requests to a controlled endpoint, causing Hoverfly to run out of memory and crash. This disrupts API simulation services and may lead to downtime or service unavailability.

Compliance Impact

This vulnerability could lead to service disruptions or data processing failures, potentially violating availability requirements in GDPR or HIPAA. Downtime may impact systems handling sensitive data.

Mitigation Strategies

Upgrade Hoverfly to version 1.12.8 or later. Disable or remove any post-serve actions pointing to remote endpoints. If remote actions are necessary, ensure the endpoints are reliable and properly configured.

Hi! I’m here to help you understand CVE-2026-50018. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70