Business::GoCardless before 1.01 has three Perl webhook flaws
Original title: Business::GoCardless versions before 1.01 for Perl (3 CVEs)
Empty webhook secrets accept forgeries, and unsigned legacy payloads can exhaust memory before verification.
Robert Rothenberg reported three flaws in the Perl module Business::GoCardless before 1.01 on October 30. Legacy webhook payloads are flattened before signature checks, which can exhaust memory, and an undef or empty secret lets forged webhooks through. A third issue lets redirect flows complete without a check that the post cuts off.
Unconfirmed: The feed snippet cuts off the description of CVE-2026-119038.
- CVE-2026-119036 flattens legacy webhook payloads before signature checks.
- CVE-2026-119037 accepts forged webhooks when the secret is undef or empty.
- CVE-2026-119038 concerns redirect flows; the description is cut off.
- The fixed version named in the post is 1.01.
Impact: memory exhaustion, forged webhooks, unchecked redirects
| Product | Affected | Fixed in |
|---|---|---|
| Business::GoCardless | before 1.01 | 1.01 |
- 1.Upgrade Business::GoCardless to 1.01.
- Products
- Business::GoCardless
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-119036+1 related CVE | Memory exhaustion in Business::GoCardless before 1.01 | — | — | ||
| CVE-2026-119038 | Missing session check in Perl Business::GoCardless before 1.01 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 30 CVE-2026-119036 Business::GoCardless versions before 1. 01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature CVE-2026-119037 Business::GoCardless versions before 1. 01 for Perl accept forged webhooks when a configured webhook secret is undef or empty CVE-2026-119038 Business::GoCardless versions before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.