CVE-2026-119036

Name of the Vulnerable Software and Affected Versions Business::GoCardless versions prior to 1.01

Description An issue exists where memory exhaustion can occur when flattening legacy webhook payloads before the signature is verified. When a webhook body contains a top-level payload key, it is treated as a legacy webhook. The process of rebuilding the signed string involves flattening the payload into key-value pairs for each leaf, where each key includes the full path to that leaf. If a long key contains a long array, memory consumption becomes proportional to the product of the key length and the array length. A remote attacker can trigger this memory exhaustion using a single request that lacks a valid signature.

Recommendations Update Business::GoCardless to version 1.01 or later.