CVE-2026-116486

A flaw was found in Objenesis. The library caches object instantiators using only the class name rather than the unique class identity across separate class loaders. A local attacker can exploit this behavior in shared caching environments with identically named classes to induce type confusion. Successful exploitation allows unexpected object substitution, potentially resulting in application crashes or data integrity issues.

A flaw was found in the Objenesis library's instantiator caching mechanism, which caches objects using only the class name rather than the unique class identity. A local attacker can exploit this in shared environments by loading identically named classes across different class loaders to induce type confusion. This results in unexpected object substitution, leading to application crashes or data integrity corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not share a single Objenesis instance across multiple class loaders within the same application. Instantiate separate, isolated Objenesis instances for each class loader environment to prevent cache collisions.