CVE-2026-50018: Spectolabs Hoverfly

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Affected products

• Spectolabs Hoverfly: before 1.12.8 (fixed in 1.12.8)

Published 2026-09-11. Last modified 2026-09-30.