148 matches found
Hoverfly < 1.10.3 - Arbitrary File Read
Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...
GO-2026-5977 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly...
GO-2026-5975 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly...
Uncontrolled Resource Consumption
github.com/spectolabs/hoverfly is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the use of http.DefaultClient without a configured timeout for remote post-serve actions, which allows an attacker to trigger requests to a non-responsive endpoint,...
Concurrent Execution Using Shared Resource
github.com/spectolabs/hoverfly is vulnerable to Concurrent Execution using Shared Resource. The vulnerability is due to the AddDiff function writing to the shared responsesDiff map without proper synchronization when running in Diff mode, which allows an attacker to send multiple simultaneous...
CVE-2026-50013
creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:13+00:00| published-proof-of-concept| https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg...
CVE-2026-50018
creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:11+00:00| published-proof-of-concept| https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7...
Missing Synchronization
Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...
GHSA-QRH4-P6V4-MRFG Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...
Exploit for Improper Input Validation in Hoverfly
CVE-2025-54123 — Hoverfly Middleware API Remote Code Execution...
📄 Hoverfly 1.11.3 Remote Command Execution
This Python script is an exploitation tool targeting a vulnerable Hoverfly API endpoint, specifically the /api/v2/hoverfly/middleware functionality, which allows execution of user-supplied input through a backend binary...
ffensive-playbook
HackTheBox — Writeups Collection A collection of HackTheBox m...
ofensive-playbook
HackTheBox — Writeups Collection A collection of HackTheBox m...
Exploit for OS Command Injection in Hoverfly
CVE-2025-54123 Hoverfly CVE RCE Usage bash python3 CVE...
Exploit for OS Command Injection in Hoverfly
CVE-2025-54123 - Hoverfly Command Injection RCE PoC CVE-2...
Exploit for OS Command Injection in Hoverfly
CVE-2025-54123 A PoC demonstrating a RCE in Hoverfly version...
Exploit for OS Command Injection in Hoverfly
CVE-2025-54123 Exploit Hoverfly Authenticated Middleware Comm...
Hoverfly <= 1.11.3 - Remote Code Execution
Hoverfly versions 1.11.3 and below are vulnerable to remote code execution RCE via command injection in the middleware API endpoint /api/v2/hoverfly/middleware. Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the...
