CVE-2025-12383
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
- CVSS 4.0
- 9.4
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-25)
- CWE
- CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Affected
- eclipse:jersey
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7p63-w6x9-6gr7 | Maven | org.glassfish.jersey.core:jersey-client | >=2.45 <2.46 | 2.46 |
| GHSA-7p63-w6x9-6gr7 | Maven | org.glassfish.jersey.core:jersey-client | >=3.0.16 <3.0.17 | 3.0.17 |
| GHSA-7p63-w6x9-6gr7 | Maven | org.glassfish.jersey.core:jersey-client | >=3.1.9 <3.1.10 | 3.1.10 |