{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/businessgocardless--1.01/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-119036"},{"id":"CVE-2026-119037"},{"id":"CVE-2026-119038"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Business::GoCardless (\u003c 1.01)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eBusiness::GoCardless versions before 1.01 for Perl contain three distinct security vulnerabilities. CVE-2026-119036 allows for memory exhaustion by processing and flattening large webhook payloads before the signature validation is performed. CVE-2026-119037 permits the acceptance of forged webhooks if the webhook secret is not explicitly configured (i.e., is undef or empty). CVE-2026-119038 involves a failure to properly validate redirect flows, which may lead to unauthorized flow completion.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSystems using Business::GoCardless \u0026lt; 1.01 to process webhooks or redirect flows are susceptible to Denial of Service (via memory exhaustion) and authentication bypass or impersonation (via forged webhooks).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Business::GoCardless Perl module to version 1.01 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview application configurations to ensure a non-empty, robust webhook secret is defined for all Business::GoCardless instances to mitigate CVE-2026-119037.\u003c/li\u003e\n\u003cli\u003eAudit logs for unexpected webhook delivery patterns or incomplete/failed signature validation attempts that may indicate attempts to exploit CVE-2026-119036 or CVE-2026-119037.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T17:22:32Z","date_published":"2026-10-30T17:22:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gocardless-perl-vulnerabilities/","summary":"Business::GoCardless for Perl versions before 1.01 are vulnerable to memory exhaustion, forged webhook processing, and insufficient redirect flow validation, potentially allowing for Denial of Service and authentication bypass.","title":"Business::GoCardless for Perl: Multiple vulnerabilities (CVE-2026-119036, CVE-2026-119037, CVE-2026-119038)","url":"https://feed.craftedsignal.io/briefs/2026-10-gocardless-perl-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Business::GoCardless (\u003c 1.01)","version":"https://jsonfeed.org/version/1.1"}