p PatchFirst

PatchFirst · Latest vulnerabilities

objenesis vulnerabilities

Vulnerability published for objenesis in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-116486

    Low · CVSS 2EPSS 0.14%Fix available

    Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

    Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

    objenesisOperating systems
    • Update to 3.6-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →