CVE-2026-50013: 
Análise e mitigação de vulnerabilidades

CVE-2026-50013 is a race condition vulnerability in Hoverfly's Diff mode that causes an immediate, unrecoverable process crash when multiple concurrent proxy requests are processed. The AddDiff() function in core/hoverfly_service.go writes to the shared responsesDiff map without any mutex synchronization, triggering Go's built-in fatal concurrent map access detection. All versions of github.com/SpectoLabs/hoverfly up to and including v1.12.7 are affected; v1.12.8 contains the fix. The vulnerability was reported by researcher Kr1shna4garwal, published as a security advisory on June 3, 2026, and added to the GitHub Advisory Database on July 14, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Hoverfly Advisory).

The root cause is classified as CWE-362 (Race Condition) and CWE-820 (Missing Synchronization). In Diff mode, Go's net/http server handles each incoming proxy request in its own goroutine; each goroutine calls AddDiff() after comparing simulated and actual responses, performing an unsynchronized read and write on the shared responsesDiff map (map[v2.SimpleRequestDefinitionView][]v2.DiffReport). Unlike simple value races, Go's map runtime includes a built-in concurrent access detector that calls fatal() — which is unrecoverable and cannot be caught by recover() — immediately terminating the entire process. No authentication or admin API access is required; only access to the proxy port (default 8500) is needed to trigger the crash by sending multiple simultaneous requests (GitHub Advisory, Hoverfly Advisory).

Exploitation results in a complete denial of service: the Hoverfly process terminates immediately and unconditionally upon triggering the race condition, requiring a manual restart to restore service. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any team using Hoverfly in Diff mode for API comparison testing in CI/CD pipelines or production-like environments is affected, and in environments with real concurrent traffic the crash can occur almost immediately without deliberate attack (GitHub Advisory, Hoverfly Advisory).

A public proof-of-concept is included in the official security advisory, requiring only standard curl commands to trigger the crash with approximately 50 concurrent requests. No privileges are required and exploitation is network-accessible, making this trivially exploitable by any attacker with access to the Hoverfly proxy port. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the CVE status remains "Reserved" in the NVD. EPSS score and CISA KEV catalog status are not available for this CVE (GitHub Advisory, Hoverfly Advisory).

1. Reconnaissance: Identify a Hoverfly instance running in Diff mode, accessible via its proxy port (default 8500) and admin API port (default 8888). Confirm the version is ≤ 1.12.7.
2. Verify Diff mode: Optionally confirm the operating mode via curl http://localhost:8888/api/v2/hoverfly/mode — the response should show "mode": "diff".
3. Send concurrent requests: Use a shell loop or any HTTP load tool to send multiple simultaneous proxy requests through the Hoverfly proxy port:

for i in $(seq 1 50); do
  curl -s -x http://<target>:8500 "http://any-host.example.com/path?id=$i" &
done
wait

4. Observe crash: Each concurrent request triggers AddDiff() in a separate goroutine. When two or more goroutines access responsesDiff simultaneously, Go's runtime detects the concurrent map access and calls fatal(), immediately killing the Hoverfly process with fatal error: concurrent map read and map write.
5. Confirm denial of service: Verify the process is no longer running (pgrep -f hoverfly returns no results); the service is unavailable until manually restarted (GitHub Advisory, Hoverfly Advisory).

• Logs / Process Output: Hoverfly stderr or log output containing fatal error: concurrent map read and map write followed by a goroutine stack trace referencing github.com/SpectoLabs/hoverfly/core.(*Hoverfly).AddDiff at core/hoverfly_service.go:419 and github.com/SpectoLabs/hoverfly/core/modes.(*DiffMode).Process.
• Process: Sudden, unexpected termination of the hoverfly process; pgrep -f hoverfly returns no results after the crash.
• Network: A burst of concurrent HTTP requests arriving at the Hoverfly proxy port (default 8500) in a short time window, particularly from a single source IP or automated tool, immediately preceding the process crash.
• System: Absence of a graceful shutdown log entry — the process exits without a normal termination message, indicating a runtime fatal error rather than a controlled stop (GitHub Advisory).

Upgrade to Hoverfly v1.12.8, which introduces a dedicated sync.RWMutex protecting all access to the responsesDiff map (AddDiff and ClearDiff use write locks; GetDiff and GetFilteredDiff use read locks), and GetDiff now returns a deep snapshot to prevent re-introducing the race after lock release (Hoverfly v1.12.8 Release, Fix PR #1227). As a temporary workaround for teams unable to upgrade immediately, avoid running Hoverfly in Diff mode and use an alternative mode (e.g., Simulate or Capture) until the patch can be applied. Network-level controls such as restricting access to the proxy port to trusted clients can reduce exposure but do not eliminate the vulnerability.