Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/SpectoLabs/hoverfly | go | <= 1.12.7 | 1.12.8 |
Miggo AIRoot Cause AnalysisThe security vulnerability is a denial of service caused by a goroutine leak in Hoverfly's remote post-serve action feature. The root cause is located in the action.Action.Execute function within core/action/action.go. This function was using http.DefaultClient to make HTTP requests to remote endpoints. The http.DefaultClient in Go has no default timeout, meaning a request can hang indefinitely if the remote server accepts the connection but never sends a response. In Hoverfly, each post-serve action is spawned in a separate goroutine. An attacker can configure a remote post-serve action pointing to a controlled, non-responsive endpoint. By then sending a series of requests to Hoverfly that trigger this action, they can cause an unbounded accumulation of goroutines, each one stuck waiting for an HTTP response. This leads to excessive memory consumption and ultimately crashes the Hoverfly process. The patch mitigates this by replacing the default client with a dedicated http.Client instance that has a configurable timeout (RemoteActionTimeout, defaulted to 30 seconds), ensuring that the goroutines will always terminate and release their resources.
action.Action.Executecore/action/action.go