Description (CNA)
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SpectoLabs / hoverfly | affected < 1.12.8 |
CWE
CWE-400, CWE-770
References
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7
- https://github.com/SpectoLabs/hoverfly/pull/1228
- https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8
ADP enrichment
No English description supplied.