Description
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:jquery | >= 3.0.0-rc1, < 3.0.0 | 3.0.0 | GHSA-mhpp-875w-9cpv |
| npm | jquery | >= 3.0.0-rc.1, < 3.0.0 | 3.0.0 | GHSA-mhpp-875w-9cpv |
| NuGet | jQuery | >= 3.0.0-rc.1, < 3.0.0 | 3.0.0 | GHSA-mhpp-875w-9cpv |
| RubyGems | jquery-rails | >= 3.0.0-rc.1, < 3.0.0 | 3.0.0 | GHSA-mhpp-875w-9cpv |
Advisories 2
- VDE-2021-027 Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service CERT@VDE · May 14, 2025
- ICSA-22-097-01 Pepperl+Fuchs WirelessHART-Gateway CISA ICS & IT advisories · Apr 7, 2022