CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
An attacker can cause a denial of service in Hoverfly by triggering remote post-serve actions against unresponsive endpoints, leading to goroutine leaks and memory exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50018?
CVE-2026-50018 is a medium-severity denial of service vulnerability in SpectoLabs hoverfly, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
Which versions are affected by CVE-2026-50018?
3 open source packages ship an affected version, including github.com/SpectoLabs/hoverfly.
| Package | Affected | Fixed in |
|---|---|---|
github.com/SpectoLabs/hoverfly Go | All versions | 1.12.8 |
github.com/SpectoLabs/hoverfly Go | All versions | 1.12.8 |
github.com/SpectoLabs/hoverfly Go | All versions | 1.12.8 |
How do I fix CVE-2026-50018?
Upgrade github.com/SpectoLabs/hoverfly to 1.12.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-50018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50018 exists.
Sources
Also known as GHSA-42j2-w334-qxw7, GO-2026-5975.