CVE-2022-21700 Memory leak in micronaut-core

What is CVE-2022-21700?

CVE-2022-21700 is a medium-severity denial of service vulnerability in micronaut-projects micronaut-core, published on 18 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: ```java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionService, List<RequestArgumentBinder> binders) { super(conversionService, binders); } @Override protected void registerDefaultConverters(ConversionService<?> conversionService) { super.registerDefaultConverters(conversionService); conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> { try { return MediaType.of(charSequence); } catch (IllegalArgumentException e) { return null; } }); } } ``` ### References Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues) * Email us at [[email protected]](mailto:[email protected])

Weakness: CWE-400

Which versions are affected by CVE-2022-21700?

2 open source packages ship an affected version, including io.micronaut:micronaut-http. It affects 1 product.

Products include Objectcomputing Micronaut.

How do I fix CVE-2022-21700?

Upgrade io.micronaut:micronaut-http to 3.2.7 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-21700 being exploited?

There is no known exploitation of CVE-2022-21700 in the wild and no public exploit code.

Other vulnerabilities in micronaut-projects micronaut-core

• CVE-2020-7611 Micronaut's HTTP client is vulnerable to HTTP Request Header Injection Critical 9.8
• CVE-2026-33013 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices High 8.2
• CVE-2026-33012 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching High 7.5
• CVE-2021-32769 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core High 7.5
• CVE-2024-23639 micronaut-core management endpoints vulnerable to drive-by localhost attack Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2457-2263-mm9f.