Vulnerability advisory

GHSA-mhpp-875w-9cpv

Denial of Service in jquery

Published Jan 22, 2018Updated Sep 2, 2025OSV record ↗

Also known as CVE-2016-10707

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

jquery npm

All jquery advisories →

Affected	Fixed in
`3.0.0-rc.1` to before 3.0.0	`3.0.0`Advisories →
Also listed as affected (1) `3.0.0-rc.1`

jQuery NuGet

All jQuery advisories →

Affected	Fixed in
`3.0.0-rc.1` to before 3.0.0	`3.0.0`Advisories →
Also listed as affected (1) `3.0.0-rc.1`

org.webjars.npm:jquery Maven

All org.webjars.npm:jquery advisories →

Affected	Fixed in
`3.0.0-rc1` to before 3.0.0	`3.0.0`Advisories →
Also listed as affected (1) `3.0.0-rc1`

jquery-rails RubyGems

All jquery-rails advisories →

Affected	Fixed in
`3.0.0-rc.1` to before 3.0.0	`3.0.0`Advisories →
Also listed as affected (1) `3.0.0-rc.1`

Description

Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.

Recommendation

Update to version 3.0.0 or later.