Business::GoCardless versions before 1.01 for Perl contain a vulnerability that allows remote attackers to exhaust memory by sending specially crafted legacy webhook payloads. The flaw arises because the software flattens the payload into key-value pairs before verifying the webhook signature, leading to memory exhaustion proportional to the payload size. This can be triggered with a single request carrying no valid signature.