Skip to content
OpenAdvisories
Critical · 9.4 CVE-2025-12383 EUVD-2025-198046GHSA-7p63-w6x9-6gr7

Race Condition allows Bypass of Trust Restrictions

Published Nov 18, 2025 · Updated Nov 18, 2025 · Assigned by eclipse

Vendor: Eclipse Foundation Product: Jersey Package: celeborn-0.6 Package: celeborn-0.6-compat Package: neo4j-2025.10 Package: neo4j-2025.10-browser Package: neo4j-2025.10-docker-publish Package: org.glassfish.jersey.core:jersey-client Package: spark-4.0 Package: spark-4.0-scala-2.13-compat Ecosystem: Maven Ecosystem: Wolfi

Description

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

Affected products

VendorProductAffectedFixed
Eclipse Foundation Jersey 2.45, 3.0.16, 3.1.9 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 +1 0.6.1-r1 —
Wolfi rolling neo4j-2025.10 +2 2025.10.1-r1 —
Wolfi rolling spark-4.0 +1 4.0.1-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.glassfish.jersey.core:jersey-client >= 2.45, < 2.46 2.46 GHSA-7p63-w6x9-6gr7
Maven org.glassfish.jersey.core:jersey-client >= 3.0.16, < 3.0.17 3.0.17 GHSA-7p63-w6x9-6gr7
Maven org.glassfish.jersey.core:jersey-client >= 3.1.9, < 3.1.10 3.1.10 GHSA-7p63-w6x9-6gr7

Advisories 13

References