{"id":"CVE-2026-116486","title":"Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache","summary":"Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches insta…","severity":"medium","cvss":4.5,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-386"],"vendor":"easymock","product":"objenesis","affected":["objenesis < 3.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T15:38:10.344457Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T16:15:59.231Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116486","references":[{"url":"https://github.com/easymock/objenesis/commit/40f90f435a06b16af74a7398f0007faeaa52c00c","label":"Patch Commit"},{"url":"https://github.com/easymock/objenesis/security/advisories/GHSA-743r-26gf-97ff","label":"GitHub Security Advisory (GHSA-743r-26gf-97ff)"},{"url":"https://github.com/easymock/objenesis/blob/fb36e5c377ed1bf57a18386fa79d2eed4ddfcfac/main/src/main/java/org/objenesis/ObjenesisBase.java#L92-L95"},{"url":"https://github.com/easymock/objenesis"},{"url":"https://www.vulncheck.com/advisories/objenesis-before-3.6-type-confusion-via-class-name-instantiator-cache","label":"VulnCheck Advisory: Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T14:27:31.827Z","slug":"CVE-2026-116486","body":"## Overview\n\nObjenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.\n\n## Affected\n\n- `objenesis < 3.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":24.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}