Cyber ·
Business::GoCardless for Perl: three CVEs in versions before 1.01
Three vulnerabilities (CVE-2026-119036 to CVE-2026-119038) affect versions of Business::GoCardless for Perl before 1.01: memory exhaustion, acceptance of forged webhooks, and redirect flows completed without verification.
According to the advisory posted to the oss-sec list on 30 October 2026, the three CVEs affect versions of Business::GoCardless for Perl before 1.01. The first, CVE-2026-119036, allows memory exhaustion when legacy webhook payloads are flattened before their signature is verified. The second, CVE-2026-119037, accepts forged webhooks when the configured webhook secret is undefined or empty. The third, CVE-2026-119038, completes redirect flows without verifying the... The text received is cut off at that point, so the full detail is not available here. The relevance is direct for anyone using the library for payment notifications: confirm the installed version, upgrade to 1.01 or later, and make sure a non-empty webhook secret is configured. Rota Nacional does not fix or replace this library. To check the details, consult the original advisory in the oss-sec archive, Q4 2026, and the project's version documentation.
Original source: Business::GoCardless para Perl anterior à versão 1.01 (3 CVEs)