Business::GoCardless (< 1.01) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/businessgocardless--1.01/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:22:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBusiness::GoCardless for Perl: Multiple vulnerabilities (CVE-2026-119036, CVE-2026-119037, CVE-2026-119038)https://feed.craftedsignal.io/briefs/2026-10-gocardless-perl-vulnerabilities/Fri, 30 Oct 2026 17:22:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gocardless-perl-vulnerabilities/Business::GoCardless for Perl versions before 1.01 are vulnerable to memory exhaustion, forged webhook processing, and insufficient redirect flow validation, potentially allowing for Denial of Service and authentication bypass.Business::GoCardless versions before 1.01 for Perl contain three distinct security vulnerabilities. CVE-2026-119036 allows for memory exhaustion by processing and flattening large webhook payloads before the signature validation is performed. CVE-2026-119037 permits the acceptance of forged webhooks if the webhook secret is not explicitly configured (i.e., is undef or empty). CVE-2026-119038 involves a failure to properly validate redirect flows, which may lead to unauthorized flow completion.

Impact

Systems using Business::GoCardless < 1.01 to process webhooks or redirect flows are susceptible to Denial of Service (via memory exhaustion) and authentication bypass or impersonation (via forged webhooks).

Recommendation

  • Upgrade the Business::GoCardless Perl module to version 1.01 or later immediately.
  • Review application configurations to ensure a non-empty, robust webhook secret is defined for all Business::GoCardless instances to mitigate CVE-2026-119037.
  • Audit logs for unexpected webhook delivery patterns or incomplete/failed signature validation attempts that may indicate attempts to exploit CVE-2026-119036 or CVE-2026-119037.
]]>highadvisory