Bug 2498158 (CVE-2026-59879) - CVE-2026-59879 immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations
Summary: CVE-2026-59879 immutable-js: Immutable.js: Denial of Service due to mishandli...
Keywords:
Status: NEW
Alias: CVE-2026-59879
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2511490 2511496 2511498 2511504 2511489 2511492 2511494 2511500 2511502 2511506
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-08 17:02 UTC by OSIDB Bzimport
Modified: 2026-09-16 22:55 UTC (History)
96 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-08 17:02:42 UTC 
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.
Note You need to log in before you can comment on or make changes to this bug.