SpectoLabs github.com/SpectoLabs/hoverfly vulnerabilities

Latest SpectoLabs github.com/SpectoLabs/hoverfly CVEs

Newest publication first

1. CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

   Published 2026-09-11

   Medium·CVSS 6.5 EPSS 0.54%

   Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered p...

2. CVE-2026-50013 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

   Published 2026-09-11

   High·CVSS 7.5 EPSS 0.47%

   Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff() function writes to the shared responsesDiff map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the norma...

3. CVE-2025-54376 Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.

   Published 2025-09-10

   High·CVSS 7.8 EPSS 0.71%

   Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream rea...

4. CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

   Published 2025-09-10

   Critical·CVSS 9.8 EPSS 10.9%

   Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulne...

5. CVE-2024-45388 Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)

   Published 2024-09-02

   High·CVSS 7.5 EPSS 55.6%

   Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.