Critical

Race Condition in Eclipse Jersey Client SSL Configuration Handling

IdentifiersCVE-2025-12383CWE-362· Concurrent Execution using Shared…

CVE-2025-12383 is a race condition vulnerability in Eclipse Jersey client affecting versions 2.45, 3.0.16, and 3.1.9. Improper synchronization in the client’s handling of SSL/TLS configuration can cause critical security settings to be ignored during connection establishment. Affected settings include mutual TLS authentication requirements, custom key stores, custom trust stores, and related SSL configuration controls. In typical cases the flaw may manifest as an SSLHandshakeException, but under specific timing conditions it can instead cause the client to accept an insecure or unintended server trust context. The issue is remotely reachable through network interactions involving the vulnerable Jersey client and represents a failure to reliably enforce configured transport security policy.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can undermine the integrity of TLS authentication performed by the vulnerable Jersey client. An attacker positioned to influence or impersonate a remote endpoint may be able to cause the client to ignore configured trust restrictions, potentially resulting in unauthorized trust of an insecure server. This can defeat mutual authentication and custom trust validation, enabling man-in-the-middle style interception, exposure of sensitive data transmitted over the connection, and loss of integrity guarantees for client-server communications. Availability impact appears limited, although the flaw may also cause connection failures through SSLHandshakeException in non-exploitation cases.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by avoiding dynamic or frequently reconfigured SSL settings in affected Jersey client deployments and by using stable, pre-initialized TLS configuration where possible. Independently enforce strict endpoint and certificate validation outside the affected code path if the architecture permits. Limit the client’s ability to connect to untrusted or attacker-controlled endpoints through network segmentation, allowlisting, and proxy controls. These measures only reduce risk; the primary mitigation is to upgrade to a fixed version.

Remediation

Patch, then assume compromise.

Upgrade Eclipse Jersey client to a fixed release. Available remediation information indicates moving from affected versions 2.45, 3.0.16, and 3.1.9 to 2.46, 3.0.17, and 3.1.10 respectively. After upgrading, validate that mutual TLS, custom key stores, custom trust stores, and other SSL/TLS settings are consistently enforced in the deployed application. Regression testing should specifically cover concurrent connection establishment and any code paths that initialize or reuse SSLContext or related client TLS configuration.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

EclipseJerseyapplication

EclipseJersey-Clientapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

17 SOURCESView more in app

cyber security newsNews

Feb 10, 2026

SAP Security Patch Day - Critical Code Injection Vulnerability Fixed in SAP CRM and SAP S/4HANA

A race condition vulnerability in SAP Commerce Cloud.

security online infoNews

Feb 10, 2026

Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA Databases

High-severity race condition in SAP Commerce Cloud that could lead to unpredictable system behavior, fixed in the February 2026 patch cycle.

the hacker newsNews

Jan 26, 2026

⚡ Weekly Recap: Firewall Flaws, AI-Built Malware, Browser Traps, Critical CVEs & More

Unknown

cvefeed high severityNews

Nov 18, 2025

CVE-2025-12383 - Race Condition allows Bypass of Trust Restrictions

A race condition in Eclipse Jersey that can cause critical SSL/TLS client configuration (e.g., mutual TLS, custom key/trust stores) to be ignored, potentially resulting in unauthorized trust of insecure servers.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity9