CVE-2026-119036: Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature

Published Oct 30, 2026

Updated

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.

A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.

A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Business::GoCardless to a version that resolves this vulnerability.
Fixed in 1.01

Event History

Oct 30, 2026

CVE Published

via MITRE·12:56 PM

Data Sourced

via MITRE·12:56 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Any application using an affected version that receives webhook requests is exposed, because a remote attacker can send a single legacy-format body with a top-level "payload" key and does not need a valid signature.

What request structure causes the memory-intensive processing?

The request must be treated as a legacy webhook by including a top-level "payload" key. A long key containing a long array can cause excessive memory use because flattening creates a full-path key for every leaf before signature verification.

Does rejecting invalid webhook signatures prevent the issue?

No. The payload is flattened to reconstruct the signed string before its signature is checked, so a request with no valid signature can still exhaust memory.

How can I determine whether my application is affected?

Check whether it uses Business::GoCardless for Perl at a version before 1.01 and processes incoming webhooks. Such versions perform legacy webhook payload flattening before signature validation.

CVE-2026-119036: Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What request structure causes the memory-intensive processing?

Does rejecting invalid webhook signatures prevent the issue?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What request structure causes the memory-intensive processing?

Does rejecting invalid webhook signatures prevent the issue?

How can I determine whether my application is affected?