Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do(). An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Details: 1. Remote actions executed in goroutines without timeout (core/hoverfly.go:224-228): Post-serve actions are executed in separate goroutines with no recovery wrapper. 2. HTTP client has no timeout (core/action/action.go:128-143): http.DefaultClient has zero timeout by default in Go. If the remote server: - Accepts the TCP connection but never sends a response - Establishes TLS but never completes the handshake - Uses TCP window size 0 (flow…
Recommended action: Upgrade to 1.12.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When Hoverfly is running in Diff mode, the AddDiff() function writes to the shared responsesDiff map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a fatal error: concurrent map read and map write, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Details: 1. Unsynchronized map access in AddDiff() (core/hoverflyservice.go:417-421): 2. This function is called from Diff mode processing, which runs concurrently per request (core/modes/diffmode.go): Each incoming proxy request is handled in its own goroutine by Go's net/http server. In Diff mode, each request calls AddDiff() after comparing the simulated and actual responses. With multiple concurrent requests, multiple goroutines write to the same map simultaneously. 3. Go's runtime detects concurrent…
Recommended action: Upgrade to 1.12.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can: - Stream real-time application logs (information disclosure). - Gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. PoC 1. Start Hoverfly with authentication enabled: 2. Confirm REST API requires credentials: 3. Connect to the WebSocket endpoint without credentials: Impact Authentication bypass; an attacker receives full application logs, including proxied request/response bodies, tokens, file paths, etc.
Recommended action: Upgrade to 1.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.