Bug 2498158 (CVE-2026-59879)

Summary:	CVE-2026-59879 immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, akhatavk, akostadi, alizardo, amasferr, anjoseph, anpicker, anthomas, aos-team-art-private, aruklets, asdas, brasmith, cmah, cochase, dkeler, dmayorov, doconnor, dpaolell, dranck, dschmidt, dymurray, eaguilar, ebaron, ehelms, ggainey, gparvin, hasun, ibolton, jbalunas, jchui, jdelft, jfula, jhe, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jtolenti, jupierce, juwatts, jwong, kbempah, kshier, ktsao, lchilton, lgarciaa, mbiarnes, mdellweg, mhulan, nboldt, nmoumoul, nyancey, oaljalju, omaciel, ometelka, osousa, pantinor, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rchan, rhaigner, rhel-process-autobot, rjohnson, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sseago, stcannon, suppawar, syedriko, teagle, thason, tmalecek, tsedmik, tsze, ttakamiy, vlaad, watson-tool-maintainers, wtam, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2511490, 2511496, 2511498, 2511504, 2511489, 2511492, 2511494, 2511500, 2511502, 2511506
Bug Blocks:

Description OSIDB Bzimport 2026-07-08 17:02:42 UTC

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.