Executive brief
Hoverfly is a service virtualization tool used for API simulation and testing. A vulnerability in how it handles remote post-serve actions allows an attacker to crash the service by exhausting its memory. By directing the tool to a non-responsive web address, an attacker can cause the system to freeze or shut down, disrupting development and testing workflows.
Technical details
A goroutine leak exists in Hoverfly's remote post-serve action execution. The component uses Go's `http.DefaultClient`, which lacks a default timeout, to perform POST requests to remote endpoints. When a remote action is triggered against a non-responsive or 'black-hole' server, the spawned goroutine blocks indefinitely. Because there is no limit on the number of concurrent goroutines or a mechanism for backpressure, an attacker can flood the proxy with requests to cause unbounded memory consumption and an eventual Out-of-Memory (OOM) crash. This is exploitable if the attacker has access to the admin API to register the malicious action. The issue is fixed in version 1.12.8.
Affected products
- SpectoLabs hoverfly <= 1.12.7
Timeline
- 2026-06-03: disclosed: Initial disclosure to SpectoLabs
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 1.12.8 released
References
- https://api.github.com/users/Kr1shna4garwal
- https://github.com/Kr1shna4garwal
- https://api.github.com/users/Kr1shna4garwal/gists%7B/gist_id%7D
- https://api.github.com/users/Kr1shna4garwal/repos
- https://avatars.githubusercontent.com/u/85845881?v=4
- https://api.github.com/users/Kr1shna4garwal/events%7B/privacy%7D