Is CVE-2025-12383 actively exploited?

CVE-2025-12383 has no public evidence of in-the-wild exploitation as of 2026-01-16.

What is the CVSS score for CVE-2025-12383?

CVE-2025-12383 has a CVSS score of 9.4 (CRITICAL severity). Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

How do I patch CVE-2025-12383?

Patch guidance is available from eclipse security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2025-12383.

Fix CVE-2025-12383 - CRITICAL eclipse jersey

Q: Which products are affected by CVE-2025-12383?

3 products: eclipse jersey, eclipse jersey, eclipse jersey.

Description

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

CVSS Metrics

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector: network
Complexity: high
Privileges: none
User Action: none
Confidentiality: undefined
Integrity: undefined
Availability: undefined
Weaknesses: CWE-362 · Race Condition

Metadata

Primary Vendor: ECLIPSE
Published: 11/18/2025
Last Modified: 1/16/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2025-12383

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary