CVE-2016-10707: High severity jquery vulnerability
Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.
Recommendation
Update to version 3.0.0 or later.
Other sources
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10707?
The severity of CVE-2016-10707 is high with a severity value of 7.5.
Which versions of jQuery are affected by CVE-2016-10707?
Versions 3.0.0-rc.1 of jQuery are affected by CVE-2016-10707.
How does CVE-2016-10707 exploit the vulnerability?
CVE-2016-10707 exploits the vulnerability by entering into an infinite recursion loop when given a boolean attribute with uppercase characters, causing a denial of service.
What is the recommended remedy for CVE-2016-10707?
The recommended remedy for CVE-2016-10707 is to update to version 3.0.0 of jQuery.
Where can I find more information about CVE-2016-10707?
More information about CVE-2016-10707 can be found at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-10707), [GitHub Issue](https://github.com/jquery/jquery/issues/3133), [GitHub Advisory](https://github.com/advisories/GHSA-mhpp-875w-9cpv).