CVE-2022-21700

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: ```java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionService, List<RequestArgumentBinder> binders) { super(conversionService, binders); } @Override protected void registerDefaultConverters(ConversionService<?> conversionService) { super.registerDefaultConverters(conversionService); conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> { try { return MediaType.of(charSequence); } catch (IllegalArgumentException e) { return null; } }); } } ``` ### References Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues) * Email us at [info@micronaut.io](mailto:info@micronaut.io)

• CWE-400
• CWE-400

• https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3Patch, Third Party Advisory
• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2457-2263-mm9fMitigation, Patch, Third Party Advisory
• https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3Patch, Third Party Advisory
• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2457-2263-mm9fMitigation, Patch, Third Party Advisory

Published

Jan 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21695OnionShare is an open source tool that lets you securely and…5.3
• CVE-2022-21696OnionShare is an open source tool that lets you securely and…4.3
• CVE-2022-21697Jupyter Server Proxy is a Jupyter notebook server extension …7.1
• CVE-2022-21698client_golang is the instrumentation library for Go applicat…7.5
• CVE-2022-21699IPython (Interactive Python) is a command shell for interact…8.8
• CVE-2022-2170The Microsoft Advertising Universal Event Tracking (UET) Wor…4.8
• CVE-2022-21701Istio is an open platform to connect, manage, and secure mic…8.8
• CVE-2022-21702Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-21703Grafana is an open-source platform for monitoring and observ…8.8
• CVE-2022-21704log4js-node is a port of log4js to node.js. In affected vers…5.5
• CVE-2022-21705Octobercms is a self-hosted CMS platform based on the Larave…7.2
• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8