CVE-2016-10707
Denial of Service in jquery
CVE-2016-10707 is a high vulnerability (CVSS 7.5) in Jquery, published January 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. Fixed in jquery 3.0.0.
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
- Record
CVE-2016-10707- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-674
- Updated
- 2026-11-02
CVE List No score
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
- Record
CVE-2016-10707- Updated
- 2026-11-02
EUVDEUVD-2018-0162 No score
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
- Record
EUVD-2018-0162- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mhpp-875w-9cpv
Denial of Service in jquery
Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.
Recommendation
Update to version 3.0.0 or later.
- Record
GHSA-mhpp-875w-9cpv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-674
- Updated
- 2026-11-02
OSV
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
- Record
CVE-2016-10707- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-mhpp-875w-9cpv
Denial of Service in jquery
Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.
Recommendation
Update to version 3.0.0 or later.
- Record
GHSA-mhpp-875w-9cpv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-674
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jquerynpm |
3.0.0-rc.1 to 3.0.0-rc.1 | 3.0.0 |
jQueryNuGet |
3.0.0-rc.1 to 3.0.0-rc.1 | 3.0.0 |
jquery-railsRubyGems |
3.0.0-rc.1 to 3.0.0-rc.1 | 3.0.0 |
org.webjars.npm:jqueryMaven |
3.0.0-rc1 to 3.0.0-rc1 | 3.0.0 |
jquerynpm |
3.0.0-rc.1 up to 3.0.0 | 3.0.0 |
jQueryNuGet |
3.0.0-rc.1 up to 3.0.0 | 3.0.0 |
org.webjars.npm:jqueryMaven |
3.0.0-rc1 up to 3.0.0 | 3.0.0 |
jquery-railsRubyGems |
3.0.0-rc.1 up to 3.0.0 | 3.0.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/jquery/jquery/issues/3133
snyk.io/vuln/npm:jquery:20160529
nvd.nist.gov/vuln/detail/CVE-2016-10707
npmjs.com/advisories/330