{"id":"CVE-2026-119036","kind":"vulnerability","aliases":["CVE-2026-119036"],"related":[],"title":"Perl GoCardless module: unauthenticated webhook request exhausts server memory","description":"Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.\n\nA webhook body with a top-level \"payload\" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.\n\nA remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.","summary":"Business::GoCardless for Perl flattens webhook payloads before checking their signature, so an oversized payload consumes memory in proportion to key length times array length. A remote attacker can exhaust memory in the webhook-receiving process with one request that carries no valid signature.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gocardless","package","perl","webhooks"],"not_affected_if":["no-webhook-receiver","version-1.01-or-later"],"how_to_check":"- Check whether `Business::GoCardless` is installed and at what version, for example with `perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'`\n- Look for code that receives GoCardless webhooks and calls this module's webhook verification","fix":"- `Business::GoCardless` `1.01`","status":"open","published_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:19+00:00","updated_at":"2026-10-30T13:32:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T13:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- `Business::GoCardless` `1.01`","reach":"internet","title":"Perl GoCardless module: unauthenticated webhook request exhausts server memory","impact":"medium","summary":"Business::GoCardless for Perl flattens webhook payloads before checking their signature, so an oversized payload consumes memory in proportion to key length times array length. A remote attacker can exhaust memory in the webhook-receiving process with one request that carries no valid signature.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","gocardless","webhooks"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Webhook process runs out of memory and stops responding","analyst_note":"","how_to_check":"- Check whether `Business::GoCardless` is installed and at what version, for example with `perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'`\n- Look for code that receives GoCardless webhooks and calls this module's webhook verification","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.01-or-later","no-webhook-receiver"],"who_is_affected":"Teams running a Perl application that uses Business::GoCardless to receive GoCardless webhooks are exposed, because the flaw is in the verification path that runs before the signature check. Applications that do not receive webhooks through this module, or that run a newer version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4222,"output_tokens":535,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119036':12A,15A '-2026':11A,14A '1.01':69C 'allow':72C 'array':43B,141C,151C 'attack':47B,155C 'bodi':86C 'busi':20B,65C 'carri':61B,119C,169C 'check':28B,81C 'consum':35B 'cost':142C 'cve':10A,13A 'encod':131C 'exhaust':7A,49B,74C,157C 'flatten':24B,76C,108C 'full':121C 'gocardless':2A,16B,21B,66C 'hold':138C 'join':134C 'key':40B,93C,111C,118C,137C,147C 'leaf':116C,125C 'legaci':77C,98C 'length':41B,44B,148C,152C 'level':91C 'long':136C,140C 'memori':9A,36B,50B,73C,143C,158C 'modul':3A 'one':58B,110C 'overs':33B 'packag':17B 'pair':114C,128C 'path':122C 'payload':26B,34B,79C,92C,106C 'per':115C 'perl':1A,18B,23B,71C 'process':56B,161C 'proport':38B,144C 'rebuild':101C 'receiv':55B,162C 'remot':46B,154C 'request':6A,59B,167C 'server':8A 'sign':103C 'signatur':30B,64B,83C,172C 'singl':166C 'sort':132C 'string':104C 'time':42B,149C 'top':90C 'top-level':89C 'unauthent':4A 'valid':63B,171C 'valu':113C 'verifi':95C 'version':67C 'webhook':5A,19B,25B,54B,78C,85C,99C,163C 'webhook-receiv':53B","nicknames":[],"mitigations":[],"who_affected":"Teams running a Perl application that uses Business::GoCardless to receive GoCardless webhooks are exposed, because the flaw is in the verification path that runs before the signature check. Applications that do not receive webhooks through this module, or that run a newer version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119036","severity":null,"published_at":"2026-10-30T13:18:32+00:00","modified_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}