CVE-2026-116486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116486", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T11:37:37.948Z", "datePublished": "2026-10-26T13:08:52.051Z", "dateUpdated": "2026-10-26T16:15:59.231Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T13:08:52.051Z"}, "datePublic": "2026-10-26T00:00:00.000Z", "title": "Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache", "descriptions": [{"lang": "en", "value": "Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Symbolic Name not Mapping to Correct Object", "cweId": "CWE-386", "type": "CWE"}]}], "affected": [{"vendor": "easymock", "product": "objenesis", "defaultStatus": "unaffected", "packageURL": "pkg:maven/org.objenesis/objenesis", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "3.6"}, {"version": "3.6", "status": "unaffected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 4.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/easymock/objenesis/commit/40f90f435a06b16af74a7398f0007faeaa52c00c", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/easymock/objenesis/security/advisories/GHSA-743r-26gf-97ff", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-743r-26gf-97ff)"}, {"url": "https://github.com/easymock/objenesis/blob/fb36e5c377ed1bf57a18386fa79d2eed4ddfcfac/main/src/main/java/org/objenesis/ObjenesisBase.java#L92-L95", "tags": ["technical-description"]}, {"url": "https://github.com/easymock/objenesis", "tags": ["product"]}, {"name": "VulnCheck Advisory: Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/objenesis-before-3.6-type-confusion-via-class-name-instantiator-cache"}], "credits": [{"lang": "en", "value": "Yu Bao, PayPal Cyber Security Team", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-26T15:38:10.344457Z", "id": "CVE-2026-116486", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T16:15:59.231Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T15:38:10.344457Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:38:11.478Z"}}], "cna": {"title": "Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache", "credits": [{"lang": "en", "type": "finder", "value": "Yu Bao, PayPal Cyber Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "easymock", "product": "objenesis", "versions": [{"status": "affected", "version": "0", "lessThan": "3.6", "versionType": "custom"}, {"status": "unaffected", "version": "3.6", "versionType": "custom"}], "packageURL": "pkg:maven/org.objenesis/objenesis", "defaultStatus": "unaffected"}], "datePublic": "2026-10-26T00:00:00.000Z", "references": [{"url": "https://github.com/easymock/objenesis/commit/40f90f435a06b16af74a7398f0007faeaa52c00c", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/easymock/objenesis/security/advisories/GHSA-743r-26gf-97ff", "name": "GitHub Security Advisory (GHSA-743r-26gf-97ff)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/easymock/objenesis/blob/fb36e5c377ed1bf57a18386fa79d2eed4ddfcfac/main/src/main/java/org/objenesis/ObjenesisBase.java#L92-L95", "tags": ["technical-description"]}, {"url": "https://github.com/easymock/objenesis", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/objenesis-before-3.6-type-confusion-via-class-name-instantiator-cache", "name": "VulnCheck Advisory: Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-386", "description": "Symbolic Name not Mapping to Correct Object"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T13:08:52.051Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116486", "state": "PUBLISHED", "dateUpdated": "2026-10-26T16:15:59.231Z", "dateReserved": "2026-10-26T11:37:37.948Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-26T13:08:52.051Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:maven/org.objenesis/objenesis", "product": "objenesis", "vendor": "easymock", "versions": [{"lessThan": "3.6", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "3.6", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures."}], "id": "CVE-2026-116486", "lastModified": "2026-10-26T18:39:42.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116486", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T15:38:10.344457Z", "version": "2.0.3"}}]}, "published": "2026-10-26T14:16:37.200", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/easymock/objenesis"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/easymock/objenesis/blob/fb36e5c377ed1bf57a18386fa79d2eed4ddfcfac/main/src/main/java/org/objenesis/ObjenesisBase.java#L92-L95"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/easymock/objenesis/commit/40f90f435a06b16af74a7398f0007faeaa52c00c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/easymock/objenesis/security/advisories/GHSA-743r-26gf-97ff"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/objenesis-before-3.6-type-confusion-via-class-name-instantiator-cache"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-386"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.objenesis/objenesis: objenesis: Type confusion via instantiator cache collisions", "id": "2560717", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560717"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in Objenesis. The library caches object instantiators using only the class name rather than the unique class identity across separate class loaders. A local attacker can exploit this behavior in shared caching environments with identically named classes to induce type confusion. Successful exploitation allows unexpected object substitution, potentially resulting in application crashes or data integrity issues."], "name": "CVE-2026-116486", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Out of support scope", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Fix deferred", "package_name": "objenesis", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "objenesis", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "objenesis", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "objenesis", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "javapackages-tools:201801/objenesis", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "javapackages-tools:201801/powermock", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "jmc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "objenesis", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "bazel6", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "bazel7", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "bazel8", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "objenesis", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "maven3.9", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-26T13:08:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116486\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116486\nhttps://github.com/easymock/objenesis\nhttps://github.com/easymock/objenesis/blob/fb36e5c377ed1bf57a18386fa79d2eed4ddfcfac/main/src/main/java/org/objenesis/ObjenesisBase.java#L92-L95\nhttps://github.com/easymock/objenesis/commit/40f90f435a06b16af74a7398f0007faeaa52c00c\nhttps://github.com/easymock/objenesis/security/advisories/GHSA-743r-26gf-97ff\nhttps://www.vulncheck.com/advisories/objenesis-before-3.6-type-confusion-via-class-name-instantiator-cache"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "3.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "objenesis", "source": "cna", "vendor": "easymock"}, "product": "objenesis", "vendor": "easymock"}], "created": "2026-10-26T15:45:12.685046+00:00", "updated": "2026-10-27T13:45:02.809936+00:00", "vendors": ["easymock", "easymock$PRODUCT$objenesis"]}