{"schemaVersion":3,"id":"CVE-2026-59879","aliases":["UBUNTU-CVE-2026-59879","DEBIAN-CVE-2026-59879","CGA-2xjc-6932-rm83","CGA-5fpm-86jf-x8q9","CGA-5qg5-9qmw-c9h7","CGA-8h94-5h7m-49cr","CGA-93rf-3w94-ppc3","CGA-98p5-3gg5-cgx6","CGA-j569-69j5-qpxv","CGA-jp6h-g3q3-5pqr","CGA-m7rj-p4pc-gw77","CGA-mgp3-2f8x-m522","CGA-pcmc-wwf7-8hw7","CGA-pq9j-w7vm-fr5w","CGA-rcg5-5pjq-vwhw","CGA-w29f-4whw-qj99","CGA-w7jp-86xm-cr9h","GHSA-v56q-mh7h-f735","CGA-26q8-7jfr-6c7q","CGA-29cw-73w9-8xw5","CGA-2g9h-268m-w9gg","CGA-2pmf-hvgh-h7pc","CGA-2r86-3qh3-rq4g","CGA-2rx9-p3wp-54mj","CGA-2v97-p8mc-cq8h","CGA-2xq2-gp5w-73rh","CGA-364c-v76m-j872","CGA-373c-8x46-3vgm","CGA-39vx-2wqr-99v4","CGA-3chq-wjcx-2jj4","CGA-3qj2-cwrg-2qgg","CGA-3rg5-8f4v-cjcg","CGA-475w-25rw-g95p","CGA-4q6q-j7f8-h22g","CGA-4r64-frh3-phqm","CGA-4v39-hhgr-qp26","CGA-55rg-78f7-c9j9","CGA-5j63-qfvc-4vqx","CGA-5r2q-qqmg-79fp","CGA-5v3p-h383-5pxm","CGA-5vcw-hg54-cq93","CGA-6ch9-7mm9-647h","CGA-6mc8-cvqx-q34f","CGA-6pj2-m3hp-p845","CGA-6x32-vhq8-2r2r","CGA-732v-rj63-jgfp","CGA-763p-2hw2-26gq","CGA-76h6-xgq4-43jw","CGA-7g28-wrv2-446r","CGA-82mp-rvpj-mm97","CGA-843m-qwwg-m7g3","CGA-8f32-w3pp-hmrw","CGA-8hq7-8mjf-hg58","CGA-8xgj-h6g8-xwpr","CGA-932p-w438-3wwv","CGA-97wm-fqp9-86g4","CGA-9ghv-6fp2-g43p","CGA-9xrq-3h4r-93gj","CGA-c42w-m79m-7xqh","CGA-c5jp-pv37-8wj2","CGA-c74f-h6vq-3376","CGA-c8xx-7m8p-wjcf","CGA-cgcg-hw5q-3j53","CGA-cgmg-m86h-w77m","CGA-cpcp-mrjc-fr7w","CGA-f739-mpgf-7hg3","CGA-fcpm-2x7w-vr7j","CGA-fffj-cvr5-5qvw","CGA-ffwq-h3hj-c4hc","CGA-fw29-3866-8m3f","CGA-g5vc-5623-f2pc","CGA-gcx9-jwvf-g762","CGA-gfc3-9663-4657","CGA-gh4v-632q-gmpq","CGA-gh5r-v7mr-3ppw","CGA-gmqf-228q-pmwh","CGA-h245-9xx4-rjxm","CGA-h928-g8f5-q729","CGA-hhrh-54xf-f57v","CGA-hrpc-g5h5-qfjg","CGA-j5gj-28fj-62rh","CGA-j825-c5g8-qpmc","CGA-j8rw-934m-fm5h","CGA-j9p7-fxmw-534p","CGA-jfp9-rm94-q7j2","CGA-jpj3-7c4w-6h9c","CGA-jqvr-4v6x-p3fh","CGA-jqw3-7v7r-67r6","CGA-jwh7-9fc9-cf2v","CGA-jxhh-f8wq-gh8v","CGA-m75w-2mw6-m34c","CGA-m7vp-h2wx-q7cr","CGA-m7w7-96c3-fgc3","CGA-mppq-47jx-4f7j","CGA-mv79-49hh-xv3m","CGA-p72w-f399-9xfm","CGA-p738-hm72-m7r6","CGA-p7x2-67vq-6822","CGA-pfx7-qvgj-j6pf","CGA-pw7r-x2cj-q5qf","CGA-pwhq-2r7f-vfq7","CGA-q6gp-pf7h-6wrj","CGA-q6v2-jgp2-rrv2","CGA-qc9q-j8g7-mxm4","CGA-qfg6-p26f-wq6r","CGA-qpc2-6p96-mvmv","CGA-qqrj-w47c-crgp","CGA-qrr8-hm6x-q49h","CGA-r46q-f4pw-q836","CGA-r82c-6m7r-vvj2","CGA-r8p8-fxr8-wxvq","CGA-r937-fqp9-3jgr","CGA-rm76-rhr3-26m6","CGA-vv9m-jjp3-xcfg","CGA-vxjq-c28w-mv7r","CGA-w4pg-c33j-q3xc","CGA-w64r-f22m-9hc6","CGA-wqq9-4hcx-7hf8","CGA-x8pm-qwpv-gj8v","CGA-xj37-m4gh-3322","CGA-xv2g-p7jh-6r63","CGA-xvx7-284w-pq9h"],"status":"published","duplicateOf":null,"title":null,"description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.","dates":{"published":"2026-07-08T15:47:24.885Z","modified":"2026-07-08T19:41:12.330Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.7,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00665,"percentile":0.50882,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.12199999999999997,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00543},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00665,"percentile":0.50882}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00543,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00665,"percentile":0.50882}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_IMMUTABLE-JS_IMMUTABLE-JS","name":"Immutable Js","source":"github","url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"},{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-835","name":"Loop with Unreachable Exit Condition ('Infinite Loop')","description":"The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/835.html"},{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input","description":"The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1284.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.11","name":"arangodb-3.11","label":"arangodb-3.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.11","purlType":"apk","versions":[{"text":"< 3.11.14.5-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.11.14.5-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"arangodb-3.12","name":"arangodb-3.12","label":"arangodb-3.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.12","purlType":"apk","versions":[{"text":"< 3.12.9.4-r26","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.9.4-r26","eol":null,"hubHref":null},{"vendor":"chainguard","product":"argo-workflows-ui-4.0","name":"argo-workflows-ui-4.0","label":"argo-workflows-ui-4.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/argo-workflows-ui-4.0","purlType":"apk","versions":[{"text":"< 4.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2025.12","name":"authentik-2025.12","label":"authentik-2025.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2025.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2026.2","name":"authentik-2026.2","label":"authentik-2026.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2026.2","purlType":"apk","versions":[{"text":"< 2026.2.6-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.2.6-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2026.5","name":"authentik-2026.5","label":"authentik-2026.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2026.5","purlType":"apk","versions":[{"text":"< 2026.5.6-r3","noFixRecorded":false,"fixedIn":null},{"text":"< 2026.5.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.5.6-r3 | < 2026.5.6-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-fips-2025.12","name":"authentik-fips-2025.12","label":"authentik-fips-2025.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-fips-2025.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-fips-2026.5","name":"authentik-fips-2026.5","label":"authentik-fips-2026.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-fips-2026.5","purlType":"apk","versions":[{"text":"< 2026.5.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.5.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.3","name":"gitlab-rails-ce-19.3","label":"gitlab-rails-ce-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.3","purlType":"apk","versions":[{"text":"< 19.3.1-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.1-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.3","name":"gitlab-rails-ce-fips-19.3","label":"gitlab-rails-ce-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keep-ui","name":"keep-ui","label":"keep-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keep-ui","purlType":"apk","versions":[{"text":"< 0.54.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.54.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keep-ui-fips","name":"keep-ui-fips","label":"keep-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keep-ui-fips","purlType":"apk","versions":[{"text":"< 0.54.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.54.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-34","name":"nextcloud-server-34","label":"nextcloud-server-34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-34","purlType":"apk","versions":[{"text":"< 34.0.2-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 34.0.2-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rancher-api-ui","name":"rancher-api-ui","label":"rancher-api-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rancher-api-ui","purlType":"apk","versions":[{"text":"< 1.2.3-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.3-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.5-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.5-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.2-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.2-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"argo-workflows-ui-4.0","name":"argo-workflows-ui-4.0","label":"argo-workflows-ui-4.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/argo-workflows-ui-4.0","purlType":"apk","versions":[{"text":"< 4.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.7-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rancher-api-ui","name":"rancher-api-ui","label":"rancher-api-ui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rancher-api-ui","purlType":"apk","versions":[{"text":"< 1.2.3-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.3-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.5-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.5-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.2-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.2-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"debian","product":"node-immutable","name":"node-immutable","label":"node-immutable","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-immutable","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.3.9-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.3.9-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-immutable","name":"node-immutable","label":"node-immutable","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-immutable","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"immutable-js","product":"immutable","name":"immutable","label":"immutable","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.3.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0, < 5.1.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.9 | ≥ 5.0.0, < 5.1.8","eol":null,"hubHref":"/vendor/immutable-js/immutable"},{"vendor":"immutable-js","product":"immutable-js","name":"immutable-js","label":"immutable-js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.0.0-beta.1, < 5.1.8","noFixRecorded":false,"fixedIn":null},{"text":"< 4.3.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.0.0-beta.1, < 5.1.8 | < 4.3.9","eol":null,"hubHref":"/vendor/immutable-js/immutable-js"},{"vendor":"Npm","product":"immutable","name":"immutable","label":"immutable","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/immutable","purlType":"npm","versions":[{"text":"≥ 4.0.0-rc.1, < 4.3.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.1.8","noFixRecorded":false,"fixedIn":null},{"text":"< 3.8.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.0.0-rc.1, < 4.3.9 | ≥ 5.0.0-beta.1, < 5.1.8 | < 3.8.4","eol":null,"hubHref":null}],"affectedCount":50,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735","label":"github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84","label":"github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a","label":"github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9","label":"github.com/immutable-js/immutable-js/releases/tag/v4.3.9","hostname":"github.com","tags":["X Refsource MISC","WEB","Product","Release Notes"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8","label":"github.com/immutable-js/immutable-js/releases/tag/v5.1.8","hostname":"github.com","tags":["X Refsource MISC","WEB","Product","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-59879","label":"ubuntu.com/security/CVE-2026-59879","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59879","label":"www.cve.org/CVERecord?id=CVE-2026-59879","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59879","label":"security-tracker.debian.org/tracker/CVE-2026-59879","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59879.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59879.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59879","label":"nvd.nist.gov/vuln/detail/CVE-2026-59879","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/immutable-js/immutable-js","label":"github.com/immutable-js/immutable-js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.4","label":"github.com/immutable-js/immutable-js/releases/tag/v3.8.4","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:74503"],"duplicates":[],"related":["CGA-7VJC-336F-72J3"]},"timeline":[{"kind":"published","date":"2026-07-08T15:47:24.885Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-08T19:41:12.330Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:16:37.143Z","stale":false,"partial":false}}