CVE-2025-12383 - CVE House

Back to Database

Status published Critical CVE-2025-12383

Race Condition allows Bypass of Trust Restrictions

9.4 CVSS

Vulnerability Description

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12383

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Dimitri Tenenbaum

References

https://gitlab.eclipse.org/security/cve-assignment/-/issues/74

More from Eclipse Foundation

View All →

In Jakarta Mail versions prior to 2.0.2 it is possible...

A vulnerability in the Eclipse Open VSX Registry’s automated publishing...

A denial-of-service vulnerability exists in the NetX IPv6 component functionality...

Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()

Affected Vendor

Eclipse Foundation

View all reports →

Affected Software

Jersey

Vulnerable Versions:

2.45, 3.0.16, 3.1.9

Timeline

Official Publish: November 18th, 2025

Last Modified: November 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1574 Hijack Execution Flow

T1565 Data Manipulation

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application