CVE-2026-50013: Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

Vulnerability summary

CVE-2026-50013 is a high (CVSS 7.5) vulnerability in spectolabs hoverfly. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities.

Timeline

1. 11-09-2026
   PublishedVulnerability first disclosed.
2. 14-09-2026
   Last modifiedVulnerability information updated.

Description

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

• CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-820Missing SynchronizationThe product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.