CVE-2026-116486
Received Received - Intake

Objenesis Type Confusion via Class Loader Manipulation

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116486
EUVD
EUVD-2026-109813

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
easymock objenesis 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-386 A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a type confusion issue in Objenesis versions before 3.6. It occurs because the library caches instantiators using the class name as a key. When different class loaders load classes with the same name, the cache collides, causing the wrong class objects to be returned. This leads to ClassCastException failures when newInstance() is called.

Impact Analysis

The impact includes potential object substitution attacks where malicious code could inject incorrect objects into trusted code paths. This may cause unexpected behavior, crashes via ClassCastException, or denial-of-service in applications using Objenesis for object instantiation, especially in multi-tenant or servlet environments.

Mitigation Strategies
  • Upgrade Objenesis to version 3.6 or later to address the type confusion vulnerability.
  • Review applications using Objenesis for multi-class loader environments and ensure shared ObjenesisStd instances are avoided.
  • Replace the class-name-based caching mechanism with a ClassValue-based or Class object-based approach to prevent collisions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart