CVE-2007-3816
** DISPUTED ** JWIG might allow context-dependent attackers to cause a denial of service ...
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
Exploit likelihood
What each source reports
CVE List
7.5
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
- Record
CVE-2007-3816- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2007-3800
7.5
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
- Record
EUVD-2007-3800- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hmgx-9vqc-88wc
7.5
** DISPUTED ** JWIG might allow context-dependent attackers to cause a denial of service ...
** DISPUTED ** JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG.
- Record
GHSA-hmgx-9vqc-88wc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
7.5
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
- Record
CVE-2007-3816- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3816 is a high vulnerability (CVSS 7.8) in Brics Jwig, published July 17, 2007. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile.
References
seclists.org/fulldisclosure/2007/Jul/0446.html
exchange.xforce.ibmcloud.com/vulnerabilities/35515
securityfocus.com/archive/1/473707/100/0/threaded
secniche.org/papers/HackAnnotationsInJWIG.pdf
lists.grok.org.uk/pipermail/full-disclosure/2007-July/064768.html
securitytracker.com/id?1018432
Show 7 moreShow less
securityfocus.com/archive/1/474474/100/200/threaded
securityfocus.com/bid/24974
seclists.org/bugtraq/2007/Jul/0206.html
seclists.org/fulldisclosure/2007/Jul/0451.html
lists.grok.org.uk/pipermail/full-disclosure/2007-July/064933.html
nvd.nist.gov/vuln/detail/CVE-2007-3816
github.com/advisories/GHSA-hmgx-9vqc-88wc