GitHub Advisoryadvisory · Maven

GHSA-7p63-w6x9-6gr7 Eclipse Jersey has a Race Condition

CRITICAL Published 2025-11-18 Modified 2026-02-05 Official page ↗
Aliases
CVE-2025-12383
Ecosystem
Maven
Packages
org.glassfish.jersey.core:jersey-client
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-296, CWE-362
Reviewed
2025-11-18

Affected packages

• Maven org.glassfish.jersey.core:jersey-client: >= 2.45, < 2.46 → fixed in 2.46 • Maven org.glassfish.jersey.core:jersey-client: >= 3.0.16, < 3.0.17 → fixed in 3.0.17 • Maven org.glassfish.jersey.core:jersey-client: >= 3.1.9, < 3.1.10 → fixed in 3.1.10

Description

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

Related

Alias · CVE (1)

  • CVE-2025-12383 In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual… vulnerability

Weakness · CWE (2)

  • CWE-296 Improper Following of a Certificate's Chain of Trust weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References