Race Condition allows Bypass of Trust Restrictions
Priority MEDIUM 40CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00296 22nd percentileScored 2026-11-07
Fix Fixed org.glassfish.jersey.core:jersey-client (Maven): 2.46, 3.0.17, 3.1.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Jersey | 2.45; 3.0.16; 3.1.9 | — | No fix listed | CNA |
| — | org.glassfish.jersey.core:jersey-client (Maven) | 2.45 to before 2.46 | 2.46 | Patch available | GHSA-7p63-w6x9-6gr7 |
| — | org.glassfish.jersey.core:jersey-client (Maven) | 3.0.16 to before 3.0.17 | 3.0.17 | Patch available | GHSA-7p63-w6x9-6gr7 |
| — | org.glassfish.jersey.core:jersey-client (Maven) | 3.1.9 to before 3.1.10 | 3.1.10 | Patch available | GHSA-7p63-w6x9-6gr7 |
- Jersey VendorEclipse Foundation Affected 2.45; 3.0.16; 3.1.9 Fixed in — No fix listed CNA
- org.glassfish.jersey.core:jersey-client (Maven) Vendor— Affected 2.45 to before 2.46 Fixed in 2.46 Patch available GHSA-7p63-w6x9-6gr7
- org.glassfish.jersey.core:jersey-client (Maven) Vendor— Affected 3.0.16 to before 3.0.17 Fixed in 3.0.17 Patch available GHSA-7p63-w6x9-6gr7
- org.glassfish.jersey.core:jersey-client (Maven) Vendor— Affected 3.1.9 to before 3.1.10 Fixed in 3.1.10 Patch available GHSA-7p63-w6x9-6gr7
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jersey:2.45:*:*:*:*:*:*:* | 2.45 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:jersey:3.0.16:*:*:*:*:*:*:* | 3.0.16 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:jersey:3.1.9:*:*:*:*:*:*:* | 3.1.9 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:jersey:2.45:*:*:*:*:*:*:* Versions 2.45 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:jersey:3.0.16:*:*:*:*:*:*:* Versions 3.0.16 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:jersey:3.1.9:*:*:*:*:*:*:* Versions 3.1.9 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-7p63-w6x9-6gr7 org.glassfish.jersey.core:jersey-client (Maven) Fixed in 2.46 Advisory →
- Fix · GHSA-7p63-w6x9-6gr7 org.glassfish.jersey.core:jersey-client (Maven) Fixed in 3.0.17 Advisory →
- Fix · GHSA-7p63-w6x9-6gr7 org.glassfish.jersey.core:jersey-client (Maven) Fixed in 3.1.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-12383
- 2026-10-03 Alias added: GHSA-7p63-w6x9-6gr7
References
Advisory 2
Other 11
- https://github.com/eclipse-ee4j/jersey/pull/5749
- https://github.com/eclipse-ee4j/jersey/pull/5794
- https://github.com/eclipse-ee4j/jersey/commit/425bc883d8d623ef8d3c448fafd36729f7741bcb
- https://github.com/eclipse-ee4j/jersey/commit/b2c7ba6d388cb9722f39073d7e82aa818fec49d5
- https://github.com/dtbaum/jerseyCveCandidate
- https://github.com/eclipse-ee4j/jersey
- https://github.com/eclipse-ee4j/jersey/releases/tag/2.46
- https://github.com/eclipse-ee4j/jersey/releases/tag/3.0.17
- https://github.com/eclipse-ee4j/jersey/releases/tag/3.1.10
- https://github.com/eclipse-ee4j/jersey/releases/tag/4.0.0-M2
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/253
More Eclipse Foundation Jersey vulnerabilities
- TI-2021-09397 Exposure of resource to wrong sphere in Eclipse Jersey CVSS 3.1MEDIUM 6.2
Sources
- CVE-2025-12383 · CVE Program
- CVE-2025-12383 · NVD
- FIRST EPSS
- GHSA-7p63-w6x9-6gr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences