CVE-2026-50013 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
An attacker can crash the Hoverfly API simulation tool by sending concurrent requests while it is running in Diff mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50013?
CVE-2026-50013 is a high-severity vulnerability in SpectoLabs hoverfly, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.
Which versions are affected by CVE-2026-50013?
3 open source packages ship an affected version, including github.com/SpectoLabs/hoverfly.
| Package | Affected | Fixed in |
|---|---|---|
github.com/SpectoLabs/hoverfly Go | All versions | 1.12.8 |
github.com/SpectoLabs/hoverfly Go | All versions | 1.12.8 |
github.com/SpectoLabs/hoverfly Go | All versions | 1.12.8 |
How do I fix CVE-2026-50013?
Upgrade github.com/SpectoLabs/hoverfly to 1.12.8 or later.
Is CVE-2026-50013 being exploited?
There is no known exploitation of CVE-2026-50013 in the wild and no public exploit code.
Sources
Also known as GHSA-qrh4-p6v4-mrfg, GO-2026-5977.