CVE-2026-50018

Katalog CVE

CVSS 6.5 · Medium EPSS 0,54%

Kerentanan Uncontrolled Resource Consumption. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Rincian

Terbit di NVD

11 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 44,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/SpectoLabs/hoverfly/pull/1228
• https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7