Go/github.com/SpectoLabs/hoverfly CVE-2025-54376: high 7.5, EPSS 0.71%
WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly
Action: Upgrade github.com/SpectoLabs/hoverfly to 1.12.0 or later.
go get github.com/SpectoLabs/hoverfly@v1.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.12.0 | - |
Fixed versions
| 1.12.0 |
Sources
- osv: GO-2025-3945
- nvd: CVE-2025-54376
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-jxmr-2h4q-rhxp
- https://github.com/SpectoLabs/hoverfly/commit/ffc2cc34563de67fe1a04f7ba5d78fa2d4564424
CVE-2025-54376 · published · modified · JSON