CVE-2025-12383: Eclipse Jersey has a Race Condition
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Published Nov 18, 2025 · Updated Feb 5, 2026
Affected packages
org.glassfish.jersey.core:jersey-client
- Ecosystem
- Maven
- Affected
- = 2.45
- Fixed in
- 2.46
- Check
mvn dependency:tree -Dincludes=org.glassfish.jersey.core:jersey-client
org.glassfish.jersey.core:jersey-client
- Ecosystem
- Maven
- Affected
- = 3.0.16
- Fixed in
- 3.0.17
- Check
mvn dependency:tree -Dincludes=org.glassfish.jersey.core:jersey-client
org.glassfish.jersey.core:jersey-client
- Ecosystem
- Maven
- Affected
- = 3.1.9
- Fixed in
- 3.1.10
- Check
mvn dependency:tree -Dincludes=org.glassfish.jersey.core:jersey-client
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Credited to irene221b, yeikel.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-12383
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/74
- https://github.com/eclipse-ee4j/jersey/pull/5749
- https://github.com/eclipse-ee4j/jersey/pull/5794
- https://github.com/dtbaum/jerseyCveCandidate
- https://github.com/eclipse-ee4j/jersey/releases/tag/2.46
- https://github.com/eclipse-ee4j/jersey/releases/tag/3.0.17
- https://github.com/eclipse-ee4j/jersey/releases/tag/3.1.10
- https://github.com/eclipse-ee4j/jersey/releases/tag/4.0.0-M2
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/253
- https://github.com/eclipse-ee4j/jersey/commit/425bc883d8d623ef8d3c448fafd36729f7741bcb
- https://github.com/eclipse-ee4j/jersey/commit/b2c7ba6d388cb9722f39073d7e82aa818fec49d5
- https://github.com/advisories/GHSA-7p63-w6x9-6gr7
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology