{"id":"CVE-2016-10707","published":"2018-01-18T23:00:00Z","modified":"2024-08-06T03:30:20Z","title":"jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names","vendor":null,"product":null,"tier":"tail","description":{"text":"jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03232,"percentile":0.88171,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/jquery/jquery/issues/3133","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/npm:jquery:20160529","tags":["x_refsource_MISC"]},{"url":"https://github.com/jquery/jquery/pull/3134","tags":["x_refsource_MISC"]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":17.63}]},"affected":[{"ecosystem":"npm","package":"jquery","vulnerableRanges":[">=3.0.0-rc.1, <3.0.0"],"patched":["3.0.0"],"from":["GHSA-mhpp-875w-9cpv"],"provenance":"source"},{"ecosystem":"NuGet","package":"jQuery","vulnerableRanges":[">=3.0.0-rc.1, <3.0.0"],"patched":["3.0.0"],"from":["GHSA-mhpp-875w-9cpv"],"provenance":"source"},{"ecosystem":"Maven","package":"org.webjars.npm:jquery","vulnerableRanges":[">=3.0.0-rc1, <3.0.0"],"patched":["3.0.0"],"from":["GHSA-mhpp-875w-9cpv"],"provenance":"source"},{"ecosystem":"RubyGems","package":"jquery-rails","vulnerableRanges":[">=3.0.0-rc.1, <3.0.0"],"patched":["3.0.0"],"from":["GHSA-mhpp-875w-9cpv"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0162","exploited":false,"provenance":"source"}}