CVE-2026-50018

Executive Summary

CVE-2026-50018 is a denial-of-service vulnerability in Hoverfly, an open-source API simulation tool, affecting versions prior to 1.12.8. Remote post-serve actions invoke http.DefaultClient without a timeout, so requests to an unreachable or deliberately slow endpoint cause goroutines to block indefinitely, accumulating without bound until memory is exhausted and the process is OOM-killed. Exploitation requires only that a victim trigger proxy requests configured with a remote post-serve action; no binary execution is needed and CVSS rates availability impact High (6.5).

Technical Analysis

Hoverfly is a lightweight service virtualization / API simulation tool used widely in development, CI, and test environments. It supports "post-serve actions" — logic executed after Hoverfly serves a simulated response — which can be either local (binary execution) or remote (an HTTP call to an external endpoint).

The vulnerability class is uncontrolled resource consumption (CWE-400), specifically unbounded concurrency / goroutine leak. Per the NVD description, prior to version 1.12.8, remote post-serve actions use Go's http.DefaultClient with no timeout configuration. This is significant because http.DefaultClient has no default timeout — a client with no timeout will wait indefinitely for a response. Go's net/http will only abort a request if the connection fails or the server closes it; a hostile or malfunctioning endpoint that accepts the TCP connection but never sends a response leaves the request blocked indefinitely.

When a proxy request is triggered (each triggering the configured remote post-serve action), the implementation spawns a goroutine that calls http.DefaultClient.Do() and blocks on it. Because there is no timeout, the goroutine never returns and never releases its associated memory (request structs, buffers, connection state). Each triggered request adds another permanently-blocked goroutine. With enough triggering requests, goroutine count and memory footprint grow without bound, eventually causing memory exhaustion and an OOM kill of the Hoverfly process.

Key attack-surface characteristics:

• No authentication required to be the attacker in the sense described: the attacker only needs to control (or cause Hoverfly to target) a non-responsive endpoint. The description explicitly contrasts this with local post-serve actions, which require binary execution. The remote variant requires only a URL pointing to a non-responsive endpoint.
• The blocked call is on the client side of an outbound HTTP request, not on the inbound listener, so the symptom is silent goroutine accumulation rather than connection-pool saturation of inbound listeners.
• CVSS reflects this: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:R (user interaction — a victim/operator must trigger the proxy request flow), S:U (unchanged scope), C:N/I:N (no confidentiality or integrity impact), A:H (high availability impact).

No function names, endpoints, or file paths beyond http.DefaultClient.Do() and http.DefaultClient (as given in the NVD description) are asserted here. Insufficient technical detail is available on exact Hoverfly configuration key names or internal call sites; those are not invented.

Exploitation Scenarios

No public PoC is available (POC_STATUS: None). The attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An adversary identifies a Hoverfly instance in use — commonly in development, staging, or CI/CD environments where Hoverfly simulates third-party APIs. Hoverfly instance exposure and configuration (e.g., the presence of remote post-serve actions pointed at a reachable URL) would be assessed. Because exploitation depends on the target having a remote post-serve action configured, the attacker benefits from environments where Hoverfly forwards to an external service endpoint.

2. Triggering the flaw class. The core mechanism is inducing the configured remote post-serve action to target an endpoint that accepts the TCP connection but never responds (or is unreachable/slow). The NVD description is explicit: this requires no binary execution, only a URL pointing to a non-responsive endpoint. An attacker who can influence or is the target of the remote URL — or who sets up a non-responsive endpoint that the Hoverfly configuration points at — can induce the condition. Each proxy request that triggers the post-serve action spawns a goroutine that blocks indefinitely in http.DefaultClient.Do().

3. Execution method (vulnerability-class level). There is no payload delivery in the classic sense. The "attack" is the steady generation of triggering requests while the endpoint stays silent. Each such request leaks one goroutine that never terminates. No malformed input, no injection, no memory-corruption primitive — purely resource consumption via a blocking I/O wait with no timeout.

4. Post-exploitation impact. Unbounded goroutine accumulation leads to memory exhaustion and an OOM kill of the Hoverfly process. The result is availability loss: Hoverfly stops serving simulated API responses, disrupting dependent development, integration test, and CI/CD pipelines that rely on it. Note the UI:R component — a user/operator action (triggering the proxy request path) is part of the causal chain, which is why CVSS requires user interaction even though no privileges are required.

Constraints and caveats: This is a pre-authentication-agnostic, low-complexity availability attack but it is not remote code execution, and there is no confidentiality or integrity impact. There is no evidence of exploit code, nuclei templates, or in-the-wild exploitation (CISA KEV: NO; EPSS: not scored).

Impact Assessment

Business impact. Hoverfly is a development/test tool. Its most consequential deployments are in CI/CD pipelines and integration environments where it simulates unreliable or unavailable upstream APIs. A successful DoS can halt test suites, block deployments gated on integration tests, and cause cascading CI failures. In production-adjacent staging environments, an outage could delay release cycles. Because the crash is an OOM kill, recovery requires a restart (and potentially a host with more memory if OOM pressure is recurring).

Affected systems. Hoverfly instances running versions prior to 1.12.8 that are configured with remote post-serve actions pointing at endpoints an attacker can make non-responsive. Instances without remote post-serve actions, or with only local post-serve actions, are not affected by this specific remote-endpoint vector.

Blast radius. CVSS S:U (scope unchanged) means impact is confined to the vulnerable component itself — the Hoverfly process. There is no lateral movement, no data exposure (C:N), and no data modification (I:N). The full impact is availability (A:H).

CVSS subscores. AV:N (network-reachable configuration), AC:L (low complexity — simply requires a non-responsive endpoint), PR:N (no privileges needed), UI:R (a triggering request must occur), S:U, C:N, I:N, A:H → Base score 6.5 (Medium).

Likelihood. EPSS is not yet scored by FIRST.org; no exploit code, no nuclei template, and no CISA KEV listing exist. Exploitation is technically straightforward for anyone with visibility into the configuration, but requires the specific deployment characteristic (remote post-serve action). Target specificity reduces broad opportunistic risk; however, low complexity means any adversary who can reach or set the remote URL can sustain the DoS.

Detection Guidance

Sigma Rule

title: Hoverfly Remote Post-Serve Action Goroutine Exhaustion (CVE-2026-50018)
id: 6d1f2c9a-4b7e-4c21-9f3a-8e2b5c7d1a44
status: experimental
description: Detects Hoverfly process crashes consistent with unbounded goroutine accumulation and OOM kill triggered by a non-responsive remote post-serve action endpoint (CVE-2026-50018).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50018
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith: 'hoverfly'
  selection_oom:
    message|contains|all:
      - 'Out of memory'
      - 'hoverfly'
  selection_kill:
    message|contains: 'Killed process'
  condition: selection_process and (selection_oom or selection_kill)
falsepositives:
  - Legitimate Hoverfly restarts under normal heavy load
  - Other processes OOM-killed on the same host
level: medium
tags:
  - attack.t1499
  - cve.2026.50018

YARA Rule

rule CVE_2026_50018_Hoverfly_RemotePostServe
{
    meta:
        author = "valtersit.com"
        description = "Detects Hoverfly binaries/configuration referencing remote post-serve actions without timeout handling (CVE-2026-50018)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50018"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a1 = "http.DefaultClient" ascii wide
        $a2 = "hoverfly" ascii nocase
        $b1 = "post-serve" ascii nocase
        $b2 = "postserve" ascii nocase
        $c1 = "remote" ascii nocase
        $c2 = "timeout" ascii nocase

    condition:
        uint32(0) == 0x464c457f and
        $a2 and
        ($b1 or $b2) and
        $c1
}

Note: This is an indicative binary/string-signature rule. It matches Hoverfly artifacts referencing post-serve action and remote handling. It does not prove exploitability, and file-level rules against compiled Go binaries may require tuning.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-50018 Hoverfly Remote Post-Serve Action Connection Without Response"; flow:established,to_server; content:"POST|20|"; http_method; threshold:type limit, track by_src, count 20, seconds 60; classtype:attempted-dos; sid:2026500018; rev:1; reference:cve,2026-50018; metadata:created_at 2026_01_01, affected_product Hoverfly, former_category DOS;)

Note: This rule is heuristic — it flags sustained outbound HTTP POST volumes from a Hoverfly host to an external endpoint, a pattern consistent with repeated triggered remote post-serve actions while responses never return. Network rules cannot see the goroutine leak directly, so interpretation requires correlating with the application role.

Elastic Detection

process where host.os.type == "linux" and
event.category == "process" and
(process.name == "hoverfly" or process.executable : "*hoverfly*") and
event.action == "end" and
process.exit_code != 0

Note: EQL above detects abnormal Hoverfly process termination, consistent with OOM kill. It is an availability-symptom detection; correlate with memory.pressure / kernel OOM events for confidence.

Splunk SPL Query

index=os sourcetype=syslog
("Out of memory" OR "oom-kill" OR "Killed process")
| rex field=_raw "Killed process (?<pid>\d+) \((?<proc>hoverfly)\)"
| where proc="hoverfly"
| stats count min(_time) as first_seen max(_time) as last_seen by host, pid
| convert ctime(first_seen) ctime(last_seen)

Note: This queries kernel/log OOM-killer events targeting the hoverfly process, the observable consequence of unbounded goroutine accumulation in CVE-2026-50018.

Wazuh OSSEC Rule

<group name="hoverfly,cve-2026-50018,">
  <rule id="100518" level="10">
    <decoded_as>syslog</decoded_as>
    <match>Killed process</match>
    <regex>hoverfly</regex>
    <description>CVE-2026-50018: Hoverfly process OOM-killed - potential goroutine exhaustion DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,pci_dss_10.2.4,</group>
  </rule>

  <rule id="100519" level="8">
    <decoded_as>syslog</decoded_as>
    <match>Out of memory</match>
    <regex>hoverfly</regex>
    <description>CVE-2026-50018: Out-of-memory condition associated with hoverfly</description>
    <group>dos,</group>
  </rule>
</group>

Note: These rules match OOM-killer and memory-pressure log events associated with the hoverfly process. Because Wazuh rules are deployment- and log-source-specific, verify the syslog decoder and field names against your environment.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix reference, workaround, or affected-version list is present in the tracked data beyond the version assertion in the NVD description (fix in 1.12.8).

1) Immediate mitigations (no code change required):

• Eliminate or constrain remote post-serve actions. If remote post-serve actions are not operationally required, remove them from Hoverfly configurations. Per the description, local post-serve actions and configurations without remote post-serve actions are not exposed to this specific remote-endpoint vector.
• Ensure any configured remote post-serve endpoint is responsive and trusted. Point post-serve actions only at endpoints under your control that reliably respond. Avoid endpoints that may accept connections without responding.
• Isolate and observe Hoverfly instances. Restrict network reachability of Hoverfly instances involved in CI/CD, and monitor process memory and goroutine counts. Set resource limits and run under a supervisor that restarts on OOM kill with alerting so crashes are visible rather than silent.
• Capacity headroom / limits. Enforce container memory limits and pod eviction policies so a memory spike from accumulated blocked goroutines is isolated and observable.

2) Patch / upgrade steps:

• Upgrade Hoverfly to version 1.12.8 or later, per the NVD description ("Version 1.12.8 patches the issue").
• After upgrade, verify remote post-serve action behavior against a deliberately slow/non-responsive endpoint to confirm requests now terminate on timeout rather than blocking indefinitely.
• Rebuild and redeploy Hoverfly derivatives, sidecars, and any CI images pinned to a Hoverfly version below 1.12.8.

3) Long-term hardening:

• Inventory Hoverfly deployments. Identify all instances (dev, staging, CI/CD) and their post-serve action configurations, and flag any remote post-serve actions.
• Make HTTP clients time-bound. As a hardening principle, all outbound HTTP clients (including any based on http.DefaultClient) should be replaced with clients carrying explicit connect/read/write timeouts. (This is a general Go-hardening recommendation; the patch itself is vendor-supplied.)
• Pipeline resilience. Design CI/CD so a Hoverfly outage fails fast rather than hanging indefinitely, and decouple deployment gates from single Hoverfly instances where feasible.
• Monitoring. Track goroutine count, resident memory, and OOM-kill events for Hoverfly instances as standing metrics, and alert on monotonic goroutine growth.

References

• NVD — CVE-2026-50018: https://nvd.nist.gov/vuln/detail/CVE-2026-50018
• Hoverfly project (open source API simulation tool) — release 1.12.8 (fix version per NVD description); see project repository/advisories for the patch.
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV Catalog — not applicable (CVE-2026-50018 is NOT listed in the Known Exploited Vulnerabilities catalog as of this report).

Threat actor / exploit-in-the-wild evidence: None. No public PoC, no nuclei template, no exploit code, and no CISA KEV listing were identified in the tracked data. EPSS has not yet scored this CVE. Any "exploitation" of this issue is at the availability/DoS level and produces process crashes rather than code execution, so it is unlikely to appear in KEV absent evidence of active DoS campaigns targeting Hoverfly deployments.