CVE-2026-119036

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.

A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length.

A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
—	—	< 1.01

References

https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes

Timeline

Published: Oct 30, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1190377.5Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_val CVE-2026-1190386.1Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flo CVE-2026-1190395.3The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout deci CVE-2026-119045.3IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container CVE-2026-1190407.5The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default c CVE-2026-1190484.2JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated CVE-2026-1190497.6FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbo CVE-2026-119054.3The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve CVE-2026-1190508.1Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by CVE-2026-1190515.9flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arr CVE-2026-1190527.5llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attacke CVE-2026-1190535.3lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds co