Objenesis before 3.6 contains a type‑confusion vulnerability that lets code in one class loader substitute objects into another by using an instantiator cache keyed on class name. The cached instantiators are returned for classes with the same fully‑qualified name, causing newInstance() to produce an object of an unexpected type, which in turn leads to ClassCastException failures or other logic errors. This flaw is related to CWE‑386, a type safety violation.

The library affected is EasyMock’s Objenesis. Versions prior to 3.6 are vulnerable. Any Java application that includes Objenesis earlier than 3.6 and shares a single ObjenesisStd instance between multiple class loaders is at risk.

The CVSS score of 2 indicates a low severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely exploited. The attack vector is inferred to be local within an application that uses Objenesis; an attacker would need to influence class loading in a shared class loader environment, which can lead to application crashes or aborts but not remote code execution. Thus, the primary risk is a denial‑of‑service scenario.