CVE-2025-12383
High · 8.7Eclipse Jersey has a Race Condition
CVSS
8.7
EPSS
0.3%
Published
Nov 18, 2025
CISA due date
—
The record
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.glassfish.jersey.core:jersey-client | 2.45 | 2.46 |
| Maven | org.glassfish.jersey.core:jersey-client | 3.0.16 | 3.0.17 |
| Maven | org.glassfish.jersey.core:jersey-client | 3.1.9 | 3.1.10 |
| Chainguard | apache-hop | 0 | 2.16.0-r0 |
| Chainguard | apache-hop-fips | 0 | 2.15.0-r16 |
| Chainguard | apache-pulsar | 0 | 4.1.2-r0 |
| Chainguard | apache-pulsar-compat | 0 | 4.1.2-r0 |
| Chainguard | celeborn-0.5 | 0 | 0.5.4-r10 |
| Chainguard | celeborn-0.5-compat | 0 | 0.5.4-r10 |
| Chainguard | celeborn-0.6 | 0 | 0.6.1-r1 |
| Chainguard | celeborn-0.6-compat | 0 | 0.6.1-r1 |
| Chainguard | kafka-3.7 | 0 | 3.7.2-r47 |
| Chainguard | kafka-3.8 | 0 | 3.8.1-r47 |
| Chainguard | kafka-3.9 | 0 | 3.9.1-r6 |
| Chainguard | kafka-4.0 | 0 | 4.0.1-r1 |
| Chainguard | kafka-bitnami-compat-3.7 | 0 | 3.7.2-r47 |
| Chainguard | kafka-bitnami-compat-3.8 | 0 | 3.8.1-r47 |
| Chainguard | kafka-bitnami-compat-3.9 | 0 | 3.9.1-r6 |
| Chainguard | kafka-bitnami-compat-4.0 | 0 | 4.0.1-r1 |
| Chainguard | kafka-iamguarded-compat-4.0 | 0 | 4.0.1-r1 |
| Chainguard | neo4j-2025.04 | 0 | 2025.04.0-r9 |
| Chainguard | neo4j-2025.04-docker-publish | 0 | 2025.04.0-r9 |
| Chainguard | neo4j-2025.05 | 0 | 2025.05.1-r8 |
| Chainguard | neo4j-2025.05-docker-publish | 0 | 2025.05.1-r8 |
| Chainguard | neo4j-2025.06 | 0 | 2025.06.2-r8 |
| Chainguard | neo4j-2025.06-browser | 0 | 2025.06.2-r8 |
| Chainguard | neo4j-2025.06-docker-publish | 0 | 2025.06.2-r8 |
| Chainguard | neo4j-2025.07 | 0 | 2025.07.1-r8 |
| Chainguard | neo4j-2025.07-browser | 0 | 2025.07.1-r8 |
| Chainguard | neo4j-2025.07-docker-publish | 0 | 2025.07.1-r8 |
| Chainguard | neo4j-2025.08 | 0 | 2025.08.0-r5 |
| Chainguard | neo4j-2025.08-browser | 0 | 2025.08.0-r5 |
| Chainguard | neo4j-2025.08-docker-publish | 0 | 2025.08.0-r5 |
| Chainguard | neo4j-2025.09 | 0 | 2025.09.0-r2 |
| Chainguard | neo4j-2025.09-browser | 0 | 2025.09.0-r2 |
| Chainguard | neo4j-2025.09-docker-publish | 0 | 2025.09.0-r2 |
| Chainguard | neo4j-2025.10 | 0 | 2025.10.1-r1 |
| Chainguard | neo4j-2025.10-browser | 0 | 2025.10.1-r1 |
| Chainguard | neo4j-2025.10-docker-publish | 0 | 2025.10.1-r1 |
| Chainguard | neo4j-4.4 | 0 | 4.4.46-r1 |
| Chainguard | neo4j-4.4-docker-publish | 0 | 4.4.46-r1 |
| Chainguard | neo4j-5.26 | 0 | 5.26.16-r1 |
| Chainguard | neo4j-5.26-docker-publish | 0 | 5.26.16-r1 |
| Chainguard | neo4j-5.26-oci-entrypoint | 0 | 5.26.16-r1 |
| Chainguard | pyspark-scala-2.13 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-bitnami-compat | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-compat | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-minimal | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-minimal-openjdk-11 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-minimal-openjdk-17 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-minimal-openjdk-8 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-openjdk-11 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-openjdk-17 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-openjdk-8 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-bitnami-compat | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-compat | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-iamguarded-compat | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-minimal-openjdk-11 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-minimal-openjdk-17 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-minimal-openjdk-8 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-openjdk-11 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-openjdk-17 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.12-openjdk-8 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.13 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.13-compat | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.13-openjdk-11 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.13-openjdk-17 | 0 | 3.5.7-r3 |
| Chainguard | spark-3.5-scala-2.13-openjdk-8 | 0 | 3.5.7-r3 |
| Chainguard | spark-4.0 | 0 | 4.0.1-r2 |
| Chainguard | spark-4.0-scala-2.13 | 0 | 4.0.1-r2 |
| Chainguard | spark-4.0-scala-2.13-compat | 0 | 4.0.1-r2 |
| Chainguard | spark-fips-3.5 | 0 | 3.5.4-r17 |
| Chainguard | spark-fips-3.5-scala-2.12 | 0 | 3.5.4-r17 |
| Chainguard | spark-fips-3.5-scala-2.12-compat | 0 | 3.5.4-r17 |
| Chainguard | spark-fips-3.5-scala-2.13 | 0 | 3.5.4-r17 |
| Chainguard | spark-fips-3.5-scala-2.13-compat | 0 | 3.5.4-r17 |
| Chainguard | webswing | 0 | 24.2.2-r1 |
| Chainguard | wso2is | 0 | 7.2.0-r0 |
| Chainguard | wso2is-compat | 0 | 7.2.0-r0 |
| Chainguard | wso2is-doc | 0 | 7.2.0-r0 |
| Wolfi | apache-pulsar | 0 | 4.1.2-r0 |
| Wolfi | apache-pulsar-compat | 0 | 4.1.2-r0 |
| Wolfi | celeborn-0.5 | 0 | 0.5.4-r10 |
| Wolfi | celeborn-0.5-compat | 0 | 0.5.4-r10 |
| Wolfi | celeborn-0.6 | 0 | 0.6.1-r1 |
| Wolfi | celeborn-0.6-compat | 0 | 0.6.1-r1 |
| Wolfi | kafka-3.8 | 0 | 3.8.1-r47 |
| Wolfi | kafka-3.9 | 0 | 3.9.1-r6 |
| Wolfi | kafka-4.0 | 0 | 4.0.1-r1 |
| Wolfi | kafka-bitnami-compat-3.8 | 0 | 3.8.1-r47 |
| Wolfi | kafka-bitnami-compat-3.9 | 0 | 3.9.1-r6 |
| Wolfi | kafka-bitnami-compat-4.0 | 0 | 4.0.1-r1 |
| Wolfi | kafka-iamguarded-compat-4.0 | 0 | 4.0.1-r1 |
| Wolfi | neo4j-2025.04 | 0 | 2025.04.0-r9 |
| Wolfi | neo4j-2025.04-docker-publish | 0 | 2025.04.0-r9 |
| Wolfi | neo4j-2025.05 | 0 | 2025.05.1-r8 |
| Wolfi | neo4j-2025.05-docker-publish | 0 | 2025.05.1-r8 |
| Wolfi | neo4j-2025.06 | 0 | 2025.06.2-r8 |
| Wolfi | neo4j-2025.06-browser | 0 | 2025.06.2-r8 |
| Wolfi | neo4j-2025.06-docker-publish | 0 | 2025.06.2-r8 |
| Wolfi | neo4j-2025.07 | 0 | 2025.07.1-r8 |
| Wolfi | neo4j-2025.07-browser | 0 | 2025.07.1-r8 |
| Wolfi | neo4j-2025.07-docker-publish | 0 | 2025.07.1-r8 |
| Wolfi | neo4j-2025.08 | 0 | 2025.08.0-r5 |
| Wolfi | neo4j-2025.08-browser | 0 | 2025.08.0-r5 |
| Wolfi | neo4j-2025.08-docker-publish | 0 | 2025.08.0-r5 |
| Wolfi | neo4j-2025.09 | 0 | 2025.09.0-r2 |
| Wolfi | neo4j-2025.09-browser | 0 | 2025.09.0-r2 |
| Wolfi | neo4j-2025.09-docker-publish | 0 | 2025.09.0-r2 |
| Wolfi | neo4j-2025.10 | 0 | 2025.10.1-r1 |
| Wolfi | neo4j-2025.10-browser | 0 | 2025.10.1-r1 |
| Wolfi | neo4j-2025.10-docker-publish | 0 | 2025.10.1-r1 |
| Wolfi | neo4j-5.26 | 0 | 5.26.16-r1 |
| Wolfi | neo4j-5.26-docker-publish | 0 | 5.26.16-r1 |
| Wolfi | neo4j-5.26-oci-entrypoint | 0 | 5.26.16-r1 |
| Wolfi | pyspark-scala-2.13 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-bitnami-compat | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-compat | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-minimal | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-minimal-openjdk-11 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-minimal-openjdk-17 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-minimal-openjdk-8 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-openjdk-11 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-openjdk-17 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-openjdk-8 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-bitnami-compat | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-compat | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-iamguarded-compat | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-minimal-openjdk-11 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-minimal-openjdk-17 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-minimal-openjdk-8 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-openjdk-11 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-openjdk-17 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.12-openjdk-8 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.13 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.13-compat | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.13-openjdk-11 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.13-openjdk-17 | 0 | 3.5.7-r3 |
| Wolfi | spark-3.5-scala-2.13-openjdk-8 | 0 | 3.5.7-r3 |
| Wolfi | spark-4.0 | 0 | 4.0.1-r2 |
| Wolfi | spark-4.0-scala-2.13 | 0 | 4.0.1-r2 |
| Wolfi | spark-4.0-scala-2.13-compat | 0 | 4.0.1-r2 |
| maven | org.glassfish.jersey.core/jersey-client | 2.45 | No fix |
| maven | org.glassfish.jersey.core/jersey-client | 2.45 | 2.46 |
| maven | org.glassfish.jersey.core/jersey-client | 3.0.16 | No fix |
| maven | org.glassfish.jersey.core/jersey-client | 3.0.16 | 3.0.17 |
| maven | org.glassfish.jersey.core/jersey-client | 3.1.9 | No fix |
| maven | org.glassfish.jersey.core/jersey-client | 3.1.9 | 3.1.10 |
Related vulnerabilities
- CVE-2026-33871 Netty is an asynchronous, event-driven network application framework. Also affects apache-hop
- CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a… Also affects apache-hop
- CVE-2025-11143 The Jetty URI parser has some key differences to other common parsers when evaluating… Also affects apache-hop
- CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro… Also affects apache-hop
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects apache-hop
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects apache-hop
- CVE-2025-66566 yawkat LZ4 Java provides LZ4 compression for Java. Also affects apache-hop
- CVE-2025-12183 Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote… Also affects apache-hop