GHSA-7p63-w6x9-6gr7
Eclipse Jersey has a Race Condition
At a glance
- Published
- Updated
- CVE
- CVE-2025-12383
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Description
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Affected packages
| Package | Versions |
|---|---|
| Maven · org.glassfish.jersey.core:jersey-client | introduced 2.45, fixed 2.46 |
| Maven · org.glassfish.jersey.core:jersey-client | introduced 3.0.16, fixed 3.0.17 |
| Maven · org.glassfish.jersey.core:jersey-client | introduced 3.1.9, fixed 3.1.10 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-12383 ADVISORY
- https://github.com/eclipse-ee4j/jersey/pull/5749 WEB
- https://github.com/eclipse-ee4j/jersey/pull/5794 WEB
- https://github.com/eclipse-ee4j/jersey/commit/425bc883d8d623ef8d3c448fafd36729f7741bcb WEB
- https://github.com/eclipse-ee4j/jersey/commit/b2c7ba6d388cb9722f39073d7e82aa818fec49d5 WEB
- https://github.com/dtbaum/jerseyCveCandidate WEB
- https://github.com/eclipse-ee4j/jersey PACKAGE
- https://github.com/eclipse-ee4j/jersey/releases/tag/2.46 WEB
- https://github.com/eclipse-ee4j/jersey/releases/tag/3.0.17 WEB
- https://github.com/eclipse-ee4j/jersey/releases/tag/3.1.10 WEB
- https://github.com/eclipse-ee4j/jersey/releases/tag/4.0.0-M2 WEB
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/74 WEB
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/253 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |