A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.
A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
Upgrade to Business-GoCardless 1.01 or later.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length. A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature. | |
| Title | Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature | |
| Weaknesses | CWE-770 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T12:56:09.479Z
Reserved: 2026-10-29T11:38:31.744Z
Link: CVE-2026-119036
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-30T13:18:32.553
Modified: 2026-10-30T17:13:54.187
Link: CVE-2026-119036
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T14:30:08Z