CVE-2026-119037
Low risk· EPSS 2%Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and Digest::SHA treats undef and an empty string as an empty key.
Risk Assessment
A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
Recommendation
Update Business::GoCardless to version 1.01 or later and ensure the webhook secret is always set and non-empty.
Other vulnerabilities in Business::GoCardless
See all- CVE-2026-119038Low risk· EPSS 6%
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller and always accepts the flow, and since version 1.00 a flow with a mandate is returned as confirmed without being completed again.
- CVE-2026-119036Low risk· EPSS 7%
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A payload with a top-level "payload" key is flattened into key-value pairs, where a long key holding a long array costs memory proportional to the key length times the array length.
Original NVD description (English source)
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS