Live › vulnerability › CVE-2026-119036
Business::GoCardless for Perl flattens webhook payloads before checking their signature, so an oversized payload consumes memory in proportion to key length times array length. A remote attacker can exhaust memory in the webhook-receiving process with one request that carries no valid signature.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams running a Perl application that uses Business::GoCardless to receive GoCardless webhooks are exposed, because the flaw is in the verification path that runs before the signature check. Applications that do not receive webhooks through this module, or that run a newer version, can skip it.
No product ranges from the sources yet.
Business::GoCardless is installed and at what version, for example with perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'Business::GoCardless 1.01Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.
A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.
A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.
This page as .md · .json · in your agent: get_signal("CVE-2026-119036")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.