AIKIDO-2026-445557

TL;DR

The SDK verifies incoming webhook signatures by splitting the client-supplied signature header on spaces and running a separate HMAC-SHA256 verification over the full signed payload for every candidate it finds. The number of candidates is never capped, so a request whose signature header packs in many values forces one payload-sized HMAC computation per value. Because the header and body reaching a webhook endpoint are attacker-controlled and require no authentication, this amplifies a single request into a large amount of cryptographic work and can exhaust CPU. The fix caps direct verifications and switches to a single constant-work HMAC comparison once the header exceeds that limit.