Business::GoCardless for Perl: Multiple vulnerabilities (CVE-2026-119036, CVE-2026-119037, CVE-2026-119038)

Business::GoCardless versions before 1.01 for Perl contain three distinct security vulnerabilities. CVE-2026-119036 allows for memory exhaustion by processing and flattening large webhook payloads before the signature validation is performed. CVE-2026-119037 permits the acceptance of forged webhooks if the webhook secret is not explicitly configured (i.e., is undef or empty). CVE-2026-119038 involves a failure to properly validate redirect flows, which may lead to unauthorized flow completion.

Impact

Systems using Business::GoCardless < 1.01 to process webhooks or redirect flows are susceptible to Denial of Service (via memory exhaustion) and authentication bypass or impersonation (via forged webhooks).

Recommendation

• Upgrade the Business::GoCardless Perl module to version 1.01 or later immediately.
• Review application configurations to ensure a non-empty, robust webhook secret is defined for all Business::GoCardless instances to mitigate CVE-2026-119037.
• Audit logs for unexpected webhook delivery patterns or incomplete/failed signature validation attempts that may indicate attempts to exploit CVE-2026-119036 or CVE-2026-119037.