Vulnerability · Published Nov 18, 2025 · Assigned by eclipse
CVE-2025-12383Race Condition allows Bypass of Trust Restrictions
Critical 9.4
In plain English
A critical-severity race condition in Jersey from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.glassfish.jersey.core:jersey-client | 2.46 | GHSA-7p63-w6x9-6gr7 |
| Maven | org.glassfish.jersey.core:jersey-client | 3.0.17 | GHSA-7p63-w6x9-6gr7 |
| Maven | org.glassfish.jersey.core:jersey-client | 3.1.10 | GHSA-7p63-w6x9-6gr7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Jersey | 2.453.0.163.1.9 |
Weakness: CWE-362 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N