A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.
A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Business-GoCardless 1.01 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 30 Oct 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length. A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature. | |
| Title | Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature | |
| Weaknesses | CWE-770 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T12:56:09.479Z
Reserved: 2026-10-29T11:38:31.744Z
Link: CVE-2026-119036
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T13:18:32.553
Modified: 2026-10-30T13:18:32.553
Link: CVE-2026-119036
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T14:30:08Z