by Kastro
Paper/Archive/CVE-2025-12383

CVE-2025-12383

Eclipse Foundation Jersey — Race Condition allows Bypass of Trust Restrictions

EPSS 0.3%CVSS 9.4
critical.is priorityof 100
33
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 22.5.225 × 204.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

Affected

ProductAffectedFixed inSource
Jersey2.45–CNA
Jersey3.0.16–CNA
Jersey3.1.9–CNA

Scores by source

eclipse (CNA)9.4CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgitlab.eclipse.org/security/cve-assignment/-/issues/74