Bug 2560717 (CVE-2026-116486)

Summary: CVE-2026-116486 org.objenesis/objenesis: objenesis: Type confusion via instantiator cache collisions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bbrownin, bniver, dfreiber, dhanak, drosa, drow, dsimansk, ewittman, flucifre, fmariani, fmongiar, gbenhaim, gmalinko, gmeno, groman, janstey, jburrell, jnethert, jwon, kingland, mbenjamin, mcarlett, mhackett, mnovotny, nipatil, niyer, pantinor, pdelbell, pjindal, rhel-process-autobot, rkubis, rstepani, sausingh, sostapov, tcunning, twaugh, vereddy, vkumar, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Objenesis. The library caches object instantiators using only the class name rather than the unique class identity across separate class loaders. A local attacker can exploit this behavior in shared caching environments with identically named classes to induce type confusion. Successful exploitation allows unexpected object substitution, potentially resulting in application crashes or data integrity issues.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-26 14:14:00 UTC 
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.