CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2018-01-18

Last modified

2024-08-06

Weaknesses

CWE-674

Affected products

• Jquery (Jquery)

References

• https://github.com/jquery/jquery/issues/3133
• https://github.com/jquery/jquery/pull/3134
• https://snyk.io/vuln/npm:jquery:20160529