CVE-2026-50013

Name of the Vulnerable Software and Affected Versions Hoverfly version 1.12.7

Description When operating in Diff mode, the software is susceptible to a denial of service. The AddDiff() function writes to the shared responsesDiff map without proper synchronization. Because each incoming proxy request is handled in its own goroutine, multiple concurrent requests lead to simultaneous map writes. This triggers a built-in Go runtime fatal error regarding concurrent map read and map write, which immediately terminates the entire process. This condition can be triggered by sending multiple simultaneous requests through the proxy.

Recommendations As a temporary workaround, avoid using the Diff mode by not sending the {"mode":"diff"} configuration to the /api/v2/hoverfly/mode endpoint until a patch is available.