CVE-2026-116486

Name of the Vulnerable Software and Affected Versions Objenesis versions prior to 3.6

Description A type confusion issue exists where code in one class loader can substitute objects into another. This occurs because a shared ObjenesisStd instance caches instantiators using the clazz.getName() method within the getInstantiatorOf() function. When classes with the same name are used across different class loaders, they collide, leading the newInstance() function to return objects of the wrong class and resulting in ClassCastException failures.

Recommendations Update to version 3.6 or later.