---
title: "CVE-2025-12383: Eclipse Jersey has a Race Condition"
url: https://erroneo.us/security/cve/CVE-2025-12383/
description: "CVE-2025-12383 (org.glassfish.jersey.core:jersey-client (Maven)): In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-11-18
date_modified: 2026-02-05
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-12383"
kev: false
cvss: 9.4
epss: 0.00298
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-12383: Eclipse Jersey has a Race Condition

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.3% , percentile 21: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 21% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes org.glassfish.jersey.core:jersey-client (Maven) = 2.45, fixed in 2.46 ; org.glassfish.jersey.core:jersey-client (Maven) = 3.0.16, fixed in 3.0.17 ; org.glassfish.jersey.core:jersey-client (Maven) = 3.1.9, fixed in 3.1.10 . Check your lockfile, including transitive dependencies.

## What it is

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

## Affected packages

- Maven `org.glassfish.jersey.core:jersey-client` = 2.45 → fixed: 2.46
- Maven `org.glassfish.jersey.core:jersey-client` = 3.0.16 → fixed: 3.0.17
- Maven `org.glassfish.jersey.core:jersey-client` = 3.1.9 → fixed: 3.1.10

## Affected products (CVE record)

- Eclipse Foundation Jersey: 2.45, 3.0.16, 3.1.9

## Severity

- eclipse CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.30% probability of exploitation activity in the next 30 days; percentile 21.

## Sources

- [GitHub Advisory GHSA-7p63-w6x9-6gr7](https://github.com/advisories/GHSA-7p63-w6x9-6gr7)
- [CVE.org record CVE-2025-12383](https://www.cve.org/CVERecord?id=CVE-2025-12383)
- [NVD entry CVE-2025-12383](https://nvd.nist.gov/vuln/detail/CVE-2025-12383)
- [gitlab.eclipse.org](https://gitlab.eclipse.org/security/cve-assignment/-/issues/74)
- [github.com](https://github.com/eclipse-ee4j/jersey/pull/5749)
- [github.com](https://github.com/eclipse-ee4j/jersey/pull/5794)
- [github.com](https://github.com/dtbaum/jerseyCveCandidate)
- [github.com](https://github.com/eclipse-ee4j/jersey/releases/tag/2.46)
- [github.com](https://github.com/eclipse-ee4j/jersey/releases/tag/3.0.17)
- [github.com](https://github.com/eclipse-ee4j/jersey/releases/tag/3.1.10)
- [github.com](https://github.com/eclipse-ee4j/jersey/releases/tag/4.0.0-M2)
- [gitlab.eclipse.org](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/253)
- [github.com](https://github.com/eclipse-ee4j/jersey/commit/425bc883d8d623ef8d3c448fafd36729f7741bcb)
- [github.com](https://github.com/eclipse-ee4j/jersey/commit/b2c7ba6d388cb9722f39073d7e82aa818fec49d5)

---
Source page: https://erroneo.us/security/cve/CVE-2025-12383/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt