EUVD-2026-113910 reports memory exhaustion flaw in Business::GoCardless before 1.01
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Business::GoCardless
- Product
- Business::GoCardless for Perl
- First seen
Summary
The EU Vulnerability Database (EUVD) advisory EUVD-2026-113910, relayed in a Mastodon post, describes a memory exhaustion flaw in Business::GoCardless versions before 1.01 for Perl. The advisory says the module flattens legacy webhook payloads before checking their signature.
If you use Business::GoCardless
Upgrade Business::GoCardless to version 1.01 or later
Check whether your application processes legacy webhook payloads
Monitor webhook handler memory usage for abnormal growth
Verify that your webhook secret is set to a non-empty value
Review webhook logs for events that were not sent by GoCardless
Review recent payments created through redirect flows for unexpected mandates
What the sources say 3
· Mastodon: “Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate.” Source
· Mastodon: “Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.” Source
· Mastodon: “Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.” Source