---
id: "CVE-2026-119036"
kind: "vulnerability"
aliases: ["CVE-2026-119036"]
title: "Perl GoCardless module: unauthenticated webhook request exhausts server memory"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gocardless", "package", "perl", "webhooks"]
not_affected_if: ["no-webhook-receiver", "version-1.01-or-later"]
published_at: "2026-10-30T13:18:32+00:00"
first_seen_at: "2026-10-30T13:30:27+00:00"
updated_at: "2026-10-30T13:32:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119036", "first_seen_at": "2026-10-30T13:30:27+00:00"}]
---

# Perl GoCardless module: unauthenticated webhook request exhausts server memory

Business::GoCardless for Perl flattens webhook payloads before checking their signature, so an oversized payload consumes memory in proportion to key length times array length. A remote attacker can exhaust memory in the webhook-receiving process with one request that carries no valid signature.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `Business::GoCardless` is installed and at what version, for example with `perl -MBusiness::GoCardless -e 'print $Business::GoCardless::VERSION'`
- Look for code that receives GoCardless webhooks and calls this module's webhook verification

## Fix

- `Business::GoCardless` `1.01`

## Timeline

- 2026-10-30T13:30:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119036

## From the sources

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.

A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.

A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_