9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-12383

CVE-2025-12383: Race Condition allows Bypass of Trust Restrictions

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-12383

CVE-2025-12383:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.glassfish.jersey.core:jersey-client	maven	< 2.46	2.46
org.glassfish.jersey.core:jersey-client	maven	>= 3.0.0-M1, < 3.0.17	3.0.17
org.glassfish.jersey.core:jersey-client	maven	>= 3.1.0-M1, < 3.1.10	3.1.10
org.glassfish.jersey.core:jersey-client	maven	= 4.0.0-M1	4.0.0-M2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition in Eclipse Jersey's client when handling concurrent HTTPS requests. The root cause lies in the non-thread-safe lazy initialization of the default SSLSocketFactory from HttpsURLConnection. When multiple threads attempt to create HTTPS connections simultaneously, they can enter a race condition while initializing the default SSL context. This can result in some connections using a partially configured SSL context, leading to the bypass of critical security settings like custom trust stores or mutual authentication.

The analysis of the provided patches shows that the fix was applied in the org.glassfish.jersey.client.internal.HttpUrlConnector._apply method. The patch ensures that the default SSLSocketFactory is explicitly and safely initialized before any HttpURLConnection is created. This prevents the race condition from occurring. An earlier, incorrect fix attempt in org.glassfish.jersey.client.HttpUrlConnectorProvider.DefaultConnectionFactory.getConnection by adding a lock also points to the connection creation process as the place where the vulnerability manifests. Therefore, any runtime profile of an exploit would show calls to org.glassfish.jersey.client.internal.HttpUrlConnector._apply as the entry point for the vulnerable logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.