CVE-2026-116486 PUBLISHED

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

• Yu Bao, PayPal Cyber Security Team finder

• Patch Commit
• GitHub Security Advisory (GHSA-743r-26gf-97ff)
• https://github.com/easymock/objenesis/blob/fb36e5c377ed1bf57a18386fa79d2eed4ddfcfac/main/src/main/java/org/objenesis/ObjenesisBase.java#L92-L95
• https://github.com/easymock/objenesis
• VulnCheck Advisory: Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

• Symbolic Name not Mapping to Correct Object CWE