Memory Exhaustion Vulnerability in Business::GoCardless Product by Perl
CVE-2026-119036

Currently unrated

Key Information:

Status
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119036?

The Business::GoCardless product for Perl is vulnerable due to a flaw in handling legacy webhook payloads. When a webhook body includes a top-level 'payload' key, the system treats it as a legacy webhook. The process for verifying the signature involves flattening the payload into key-value pairs based on its path, which can lead to significant memory consumption. A malicious attacker can exploit this by sending a specially crafted request that does not contain a valid signature, potentially leading to memory exhaustion on the server. It is crucial for users of affected versions to upgrade to mitigate this vulnerability.

References

https://metacpan.org/release/LEEJO/Business-GoCardless-1....
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.