Objenesis
Monthly
Type confusion in Objenesis 3.5 and earlier can make newInstance() return an object of a different same-named class when one cached Objenesis/ObjenesisStd instance is shared across multiple class loaders. A local low-privileged attacker who can execute code in the same JVM as a co-tenant or plugin can win the name-keyed cache slot and cause object substitution across the trust boundary, or a repeatable ClassCastException crash when the caller uses the returned value as its own type. The risk is limited to multi-class-loader deployments that reuse a single cached instance; scores are low (CVSS 4.0 2.0; vendor CVSS 3.1 4.5), no CISA KEV entry or confirmed active exploitation is reported, and the advisory includes a proof-of-concept reproduction.
Type confusion in Objenesis 3.5 and earlier can make newInstance() return an object of a different same-named class when one cached Objenesis/ObjenesisStd instance is shared across multiple class loaders. A local low-privileged attacker who can execute code in the same JVM as a co-tenant or plugin can win the name-keyed cache slot and cause object substitution across the trust boundary, or a repeatable ClassCastException crash when the caller uses the returned value as its own type. The risk is limited to multi-class-loader deployments that reuse a single cached instance; scores are low (CVSS 4.0 2.0; vendor CVSS 3.1 4.5), no CISA KEV entry or confirmed active exploitation is reported, and the advisory includes a proof-of-concept reproduction.