Integer overflow in Immutable.js - CVE-2026-59879

Vulnerability identifier: #VU135792

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59879

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in List#set, List#setIn, List#updateIn, List#setSize, and the related functional set, setIn, and updateIn operations when processing a crafted index, size, or key-path segment in the range [2 ** 30, 2 ** 31). A remote attacker can send a specially crafted request to cause a denial of service.

A single small unauthenticated request can trigger an uncatchable infinite loop on an empty List or unbounded allocation leading to process abort on a populated List.

Immutable.js
Event Processing
InfoSphere Optim Archive Viewer
Robotic Process Automation for Cloud Pak
Data Cataloging
QRadar Threat Intelligence
IBM Fusion HCI
IBM Tivoli Netcool/OMNIbus WebGUI
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
IBM DataPower Gateway

Install security update from vendor's website.

Immutable.js - addressed in versions 4.3.9, 5.1.8
Event Processing - update to 1.5.5
IBM Fusion HCI - update to 2.14.0
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41 iFix 001
Confluence Data Center - addressed in versions 9.2.24, 10.2.17
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.11
Jira Software Data Center - update to 10.3.24
IBM DataPower Gateway - addressed in versions 10.5.0.23, 10.6.0.11, 11.0.0.3
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.7, 30.0.4
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0

• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735

• Multiple vulnerabilities in Immutable.js
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
• Multiple vulnerabilities in IBM DataPower Gateway
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging