org.objenesis/objenesis vulnerabilities

Latest org.objenesis/objenesis CVEs

Newest publication first

1. CVE-2026-116486 Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

   Published 2026-10-26

   Low·CVSS 2.0 EPSS 0.14%

   Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBas...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.