EUVD-2026-368103

fkie_cve-2026-50013

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

GHSA-qrh4-p6v4-mrfg — Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

Affected: Go: github.com/SpectoLabs/hoverfly

### Summary:

When Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests.

### Details:

**1. Unsynchronized map access in `AddDiff()` (`core/hoverfly_service.go:417-421`):**

```go func (hf *Hoverfly) AddDiff(requestView v2.SimpleRequestDefinitionView, diffReport v2.DiffReport) { if len(diffReport.DiffEntries) > 0 { diffs := hf.responsesDiff[requestView] // UNSYNCHRONIZED READ hf.responsesDiff[requestView] = append(diffs, diffReport) // UNSYNCHRONIZED WRITE } } ```

**2. This function is called from Diff mode processing, which runs concurrently per request (`core/modes/diff_mode.go`):**

Each incoming proxy request is handled in its own goroutine by Go's `net/http` server. In Diff mode, each request calls `AddDiff()` after comparing the simulated and actual responses. With multiple concurrent requests, multiple goroutines write to the same map simultaneously.

**3. Go's runtime detects concurrent map access and terminates the process:**

Unlike data races on simple values (which produce undefined behavior silently),…

Most recent entries from all

EUVD-2026-368103

fkie_cve-2026-50013

GHSA-qrh4-p6v4-mrfg — Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode