CVE-2026-116486

Medium

Description

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

SeverityMedium

CVSS4.5

Exploit probability—

ProductEasymock Objenesis

PublishedOct 26, 2026

First seenOct 26, 2026

Weakness typeCWE-386CWE-386

How to fix

Update

easymock objenesis3.6 or later

Patches

github.com/easymock/objenesis/commit/40f90f435a06b16af74a7398f0007faeaa52c00c

Vendor advisories

github.com/easymock/objenesis/security/advisories/GHSA-743r-26gf-97ff

Affected products

Product	Affected versions	Fixed in
easymock objenesis	v < 3.6	3.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.