Type confusion in Objenesis instantiator cache keyed by class name
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 14 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Objenesis before 3.6 caches instantiators by class name in a shared ObjenesisStd instance. Same-named classes from different class loaders collide in that cache, so code in one class loader can substitute objects into another, which returns wrong-class objects and causes ClassCastException failures (CWE-386). A local attacker with low privileges can trigger it.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade easymock objenesis to version 3.6, which fixes the flaw. The sources list no fixed version for Red Hat Enterprise Linux 8, 9 and 10, OpenShift Serverless, Red Hat Ceph Storage 7, 8 and 9, and other products, and Red Hat Fuse 7 has no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA objenesis (easymock) Fixed in 3.6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116486
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-27 CVSS score added · Red Hat
- 2026-10-27 Alias added: GHSA-h635-rrqm-4mjq
References
Sources
- CVE-2026-116486 · CVE Program
- CVE-2026-116486 · NVD
- FIRST EPSS
- GHSA-h635-rrqm-4mjq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116486 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences