CVE-2026-50013

Hoverfly, an open source API simulation tool, contains a data race in its Diff mode: the AddDiff() function writes to the shared responsesDiff map without any mutex or other synchronization. Because proxies normally handle many requests concurrently, multiple simultaneous proxy requests trigger concurrent map writes, which causes Go's runtime to raise a fatal 'concurrent map read and map write' error that immediately kills the entire Hoverfly process. An unauthenticated attacker who can reach the proxy can trivially crash it by sending several simultaneous requests, and can repeat this at will, gaining a remote denial of service (no confidentiality or integrity impact). Any deployment of Hoverfly prior to version 1.12.8 that runs in Diff mode and accepts requests from untrusted or semi-trusted clients is affected, though the tool is typically used in development and CI/test environments rather than internet-facing production. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; version 1.12.8 contains the fix.

What to do: Upgrade to Hoverfly 1.12.8 or later, which fixes the race. If upgrading is not immediately possible, avoid running Diff mode on any Hoverfly instance reachable by untrusted clients, restrict network access to the proxy (e.g., bind it to localhost or trusted CI networks), and consider automatic process restarts to limit outage duration. Audit your environments for Hoverfly processes running in Diff mode and confirm which versions are deployed.