4 matches found
CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
CVE-2026-116486
The Objenesis library, in versions before 3.6 , is susceptible to a type confusion vulnerability. The root cause is an instantiator caching flaw where a shared ObjenesisStd instance uses clazz.getName() as a key in ObjenesisBase.getInstantiatorOf(). This allows classes with the same name but diff...
CVE-2026-116486 Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
EUVD-2026-109813
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...