Business::GoCardless before 1.01 has three Perl webhook flaws
Empty webhook secrets accept forgeries, and unsigned legacy payloads can exhaust memory before verification.
42
Vulnerability1 · 1 read
CVE-2026-119036
Memory exhaustion in Business::GoCardless before 1.01
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Business::GoCardless for Perl flattens legacy webhook payloads into path-keyed pairs before it checks the signature. A remote attacker can send one unsigned webhook body with a long key and a long array, forcing memory use proportional to key length times array length and exhausting the process that receives webhooks. Versions before 1.01 are affected.
What to do: Upgrade Business::GoCardless to 1.01.
| Product | Affected | Fixed in |
|---|---|---|
| Business::GoCardless | before 1.01 | 1.01 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length. A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.
- Weakness
- CWE-770