spring-projects/spring-framework · error · BeanInstantiationException

Is the constructor accessible?

Error message

Is the constructor accessible?

What it means

Thrown as BeanInstantiationException by the deprecated BeanUtils.instantiate(Class) when Class.newInstance() raises IllegalAccessException, meaning the no-arg constructor exists but is not accessible from the caller (non-public and not exported/opened). The deprecated path does not call makeAccessible, unlike instantiateClass.

Source

Thrown at spring-beans/src/main/java/org/springframework/beans/BeanUtils.java:111

	 * @return the new instance
	 * @throws BeanInstantiationException if the bean cannot be instantiated
	 * @see Class#newInstance()
	 * @deprecated following the deprecation of {@link Class#newInstance()} in JDK 9
	 */
	@Deprecated(since = "5.0")
	public static <T> T instantiate(Class<T> clazz) throws BeanInstantiationException {
		Assert.notNull(clazz, "Class must not be null");
		if (clazz.isInterface()) {
			throw new BeanInstantiationException(clazz, "Specified class is an interface");
		}
		try {
			return clazz.newInstance();
		}
		catch (InstantiationException ex) {
			throw new BeanInstantiationException(clazz, "Is it an abstract class?", ex);
		}
		catch (IllegalAccessException ex) {
			throw new BeanInstantiationException(clazz, "Is the constructor accessible?", ex);
		}
	}

	/**
	 * Instantiate a class using its 'primary' constructor (for Kotlin classes,
	 * potentially having default arguments declared) or its default constructor
	 * (for regular Java classes, expecting a standard no-arg setup).
	 * <p>Note that this method tries to set the constructor accessible
	 * if given a non-accessible (that is, non-public) constructor.
	 * @param clazz the class to instantiate
	 * @return the new instance
	 * @throws BeanInstantiationException if the bean cannot be instantiated.
	 * The cause may notably indicate a {@link NoSuchMethodException} if no
	 * primary/default constructor was found, a {@link NoClassDefFoundError}
	 * or other {@link LinkageError} in case of an unresolvable class definition
	 * (for example, due to a missing dependency at runtime), or an exception thrown
	 * from the constructor invocation itself.
	 * @see Constructor#newInstance

View on GitHub (pinned to e8729d0438)

Solutions

  1. Migrate to BeanUtils.instantiateClass(clazz) which calls ReflectionUtils.makeAccessible and bypasses the access check.
  2. Make the no-arg constructor public on the target class if you own it.
  3. For modules, add 'opens <package> to spring.core;' or '--add-opens' so reflective access is permitted.
  4. Obtain the constructor yourself, call setAccessible(true), and use Constructor.newInstance / instantiateClass(ctor).

Example fix

// before
BeanUtils.instantiate(HiddenCtor.class); // package-private ctor -> IllegalAccessException

// after
BeanUtils.instantiateClass(HiddenCtor.class); // makeAccessible is applied
Defensive patterns

Strategy: validation

Validate before calling

Constructor<?> c = clazz.getDeclaredConstructor();
if (!Modifier.isPublic(c.getModifiers())) {
  // use instantiateClass(Class) which applies makeAccessible, instead of deprecated instantiate()
}

Type guard

public static boolean hasAccessibleNoArgCtor(Class<?> c) {
  try { return Modifier.isPublic(c.getDeclaredConstructor().getModifiers()); }
  catch (NoSuchMethodException e) { return false; }
}

Try / catch

try { BeanUtils.instantiate(clazz); }
catch (BeanInstantiationException e) {
  if (e.getCause() instanceof IllegalAccessException) { BeanUtils.instantiateClass(clazz); }
}

Prevention

When it happens

Trigger: BeanUtils.instantiate(Foo.class) where Foo has a package-private or protected no-arg constructor and the call originates from a different package/module, via BeanUtils.java:110-112.

Common situations: Third-party class with a non-public default constructor; JPMS module that does not open the package to Spring; calling instantiate() from a different package than the target.

Related errors


AI-assisted analysis of spring-projects/spring-framework@e8729d0438 (2026-08-04). Data as JSON: /data/errors/117a942421a79352.json. Report an issue: GitHub.