CVE-2026-119036 Details
Description
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length. A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.
A memory exhaustion vulnerability exists in Business::GoCardless versions prior to 1.01 for Perl. The issue arises when legacy webhook payloads are flattened and processed without first verifying their signature. Webhook bodies containing a top-level 'payload' key are treated as legacy webhooks. During the flattening process, the payload is converted into a series of key-value pairs, with each key representing the path to a specific leaf in the payload. These pairs are then encoded, sorted, and joined. This process can be exploited by sending a webhook with a long key that includes a lengthy array, causing memory consumption that scales with the key length and array size. As a result, a remote attacker can deplete server memory by sending a single request with an invalid signature that takes advantage of this payload processing flaw.
Users are advised to update to Business::GoCardless version 1.01 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Business::GoCardless | < 1.01 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |