The vulnerability exists when Business::GoCardless flattens the entire payload of a legacy webhook into a long key before verifying its signature. This flattening consumes memory proportional to the key length and the array size, allowing an attacker to submit a single request with an oversized payload that lacks a valid signature, leading to exhaustion of the host process memory and potentially a denial of service.

All releases of the Business::GoCardless Perl library for the GoCardless API before version 1.01 provided by LEEJO are affected. The flaw impacts any environment that processes incoming webhook payloads using this library.

An EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but memory exhaustion is a high‑impact outcome. A remote attacker who can reach the server’s webhook endpoint can trigger the flaw by sending a single crafted request. Because the library performs signature verification only after payload flattening, no authentication barrier prevents exploitation, making the vulnerability straightforward to use for anyone with network access to the endpoint.