CVE-2026-116486: Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.
Affected Software
Event History
Frequently Asked Questions
What deployment conditions are required for this issue to occur?
The issue requires a shared ObjenesisStd instance to be used across class loaders that contain different classes with the same fully qualified class name. The shared instance's instantiator cache is keyed by class name, allowing those classes to collide.
What access would an attacker or triggering component need?
The CVSS vector indicates local attack access, high attack complexity, and low privileges required, with no user interaction. A triggering component must be able to cause instantiation of same-named classes from different class loaders through the shared ObjenesisStd instance.
How can I recognize that this issue is being triggered?
Affected behavior can cause newInstance() to return an object from the wrong class, followed by ClassCastException failures. This is most relevant where class-loader isolation is expected but multiple loaders provide classes with identical names.
What is the available remediation information?
The issue affects Objenesis versions before 3.6. Updating to version 3.6 or later addresses the affected version range described here.