{"id":"CVE-2026-50013","title":"Hoverfly is an open source API simulation tool","summary":"Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-362","CWE-820"],"vendor":"SpectoLabs","product":"hoverfly","affected":["hoverfly < 1.12.8"],"patched":["github.com/SpectoLabs/hoverfly 1.12.8"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T19:17:24.620","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50013","references":[{"url":"https://github.com/SpectoLabs/hoverfly/pull/1227","label":"security-advisories@github.com"},{"url":"https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8","label":"security-advisories@github.com"},{"url":"https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-qrh4-p6v4-mrfg"}],"tags":["nvd","cve.org","ghsa","go"],"epss":0.0047,"epssPercentile":0.38086,"aliases":["GHSA-qrh4-p6v4-mrfg"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-14T17:06:19.894343Z"},"ingestedAt":"2026-07-14T18:38:32.951Z","slug":"CVE-2026-50013","body":"## Overview\n\nHoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50013)\n\nAffected packages:\n\n- `github.com/SpectoLabs/hoverfly <= 1.12.7`\n\nPatched in:\n\n- `github.com/SpectoLabs/hoverfly 1.12.8`\n\nSource: https://github.com/advisories/GHSA-qrh4-p6v4-mrfg","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}