Inefficient Algorithmic Complexity in Immutable.js - CVE-2026-59880

Vulnerability identifier: #VU135794

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59880

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in Immutable.Map and Immutable.Set collision bucket handling when processing attacker-controlled object keys. A remote attacker can supply many crafted colliding keys to cause a denial of service.

Applications are affected when untrusted input is used as keys in Immutable structures rather than only as values under fixed keys.

Immutable.js
Event Processing
InfoSphere Optim Archive Viewer
Robotic Process Automation for Cloud Pak
Data Cataloging
QRadar Threat Intelligence
IBM Fusion HCI
IBM Tivoli Netcool/OMNIbus WebGUI
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
IBM DataPower Gateway

Install security update from vendor's website.

Immutable.js - addressed in versions 4.3.9, 5.1.8
Event Processing - update to 1.5.5
IBM Fusion HCI - update to 2.14.0
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41 iFix 001
Confluence Data Center - addressed in versions 9.2.24, 10.2.17
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.11
Jira Software Data Center - update to 10.3.24
IBM DataPower Gateway - addressed in versions 10.5.0.23, 10.6.0.11, 11.0.0.3
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.7, 30.0.4
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0

• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r

• Multiple vulnerabilities in Immutable.js
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
• Multiple vulnerabilities in IBM DataPower Gateway
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging