objenesis vulnerabilities

CVEs whose affected-version data names the objenesis package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116486Medium· 4.5

today

Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches insta…

▾ Sunliteasymock · objenesisvia CVEORG