CVE-2025-12383 Race Condition allows Bypass of Trust Restrictions
A race condition in Eclipse Jersey allows bypassing SSL trust restrictions, potentially leading to unauthorized trust in insecure servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12383?
CVE-2025-12383 is a critical vulnerability in Eclipse Foundation Jersey, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Weakness: CWE-362
Which versions are affected by CVE-2025-12383?
6 open source packages ship an affected version, including org.glassfish.jersey.core:jersey-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.glassfish.jersey.core:jersey-client Maven | From 2.45 | 2.46 |
org.glassfish.jersey.core:jersey-client Maven | From 2.45 | 2.46 |
org.glassfish.jersey.core:jersey-client Maven | From 3.0.16 | 3.0.17 |
org.glassfish.jersey.core:jersey-client Maven | From 3.0.16 | 3.0.17 |
org.glassfish.jersey.core:jersey-client Maven | From 3.1.9 | 3.1.10 |
org.glassfish.jersey.core:jersey-client Maven | From 3.1.9 | 3.1.10 |
Products include Eclipse Jersey.
How do I fix CVE-2025-12383?
Upgrade org.glassfish.jersey.core:jersey-client to a fixed version for your release line: 2.46, 3.0.17 or 3.1.10.
Is CVE-2025-12383 being exploited?
There is no known exploitation of CVE-2025-12383 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Foundation Jersey
Sources
Also known as CLEANSTART-2026-EJ36501, CLEANSTART-2026-PX86604, CLEANSTART-2026-UT11406, ECHO-e2b4-dac2-0e24, GHSA-7p63-w6x9-6gr7, MINI-234w-cpv6-jj88 and 13 more.