CVE-2026-50018

Name of the Vulnerable Software and Affected Versions Hoverfly version 1.12.7

Description Remote post-serve actions use http.DefaultClient without a timeout configuration. When a remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do(). Because there is no limit on the number of active post-serve action goroutines and no context cancellation or deadline, an attacker can cause unbounded goroutine accumulation. This leads to memory exhaustion and a process crash via Out-of-Memory (OOM) kill. This issue can be triggered by registering a remote post-serve action pointing to a non-responsive endpoint and loading a simulation that triggers this action on every request.

Recommendations For version 1.12.7, restrict access to the admin API to prevent unauthorized registration of remote post-serve actions. As a temporary mitigation, avoid using remote post-serve actions that point to external or untrusted endpoints.