Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionService, List<RequestArgumentBinder> binders) { super(conversionService, binders); } @Override protected void registerDefaultConverters(ConversionService<?> conversionService) { super.registerDefaultConverters(conversionService); conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> { try { return MediaType.of(charSequence); } catch (IllegalArgumentException e) { return null; } }); } } ### References Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3 ### For more information If you have any questions or comments about this advisory: * Open an issue in Micronaut Core * Email us at info@micronaut.io
{
"cwe_ids": [
"CWE-400"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21700.json"
}{
"cpe": "cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "3.2.7"
}
],
"source": [
"CPE_RANGE",
"REFERENCES"
]
}"2026-07-22T02:23:54Z"
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1627.0,
"function_hash": "179729363634450903841203688127508465856"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-05809ec1",
"target": {
"function": "interceptCompletableFuture",
"file": "runtime/src/main/java/io/micronaut/cache/interceptor/CacheInterceptor.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"78935825455436841503059314843993633405",
"145238824509455889187724355634989577557",
"304962170422502154275805257258483125491",
"230504336565015093592834742948125019183",
"316621431223870261625585615733240583197",
"92541995954499670664010925737979018796",
"64257053902510226749540960314361790168",
"287137858923541255310235755974690671110"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-1df9fb43",
"target": {
"file": "runtime/src/main/java/io/micronaut/scheduling/io/watch/FileWatchCondition.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"165536524519270508417881441700869052018",
"142657983372128563254849207186145624034",
"270638800381323418472767245618961938045",
"237568950901803829800281097988904629746",
"141384450288324898046324590223553730722",
"233592204888616913154630188247363926704",
"113149346973378163435179105190407078679",
"264758150493450629763962489307713002231",
"233214630440653146368731806723724767952",
"67249362822052508073230889565835693473",
"42338520502450488518030570394526915329",
"20351184042760053239345146620604686504",
"170692909519453216332391493318327643984",
"274171838795309329269448330952743128704",
"319441743336684755531369680969860578147",
"277812548910399084845861400948480672329",
"237806335378713865789279582794128811445",
"326424764918315152317209685983235475459",
"325104140562350316825741215890753711486",
"299984275478450902609568408899266165284",
"329969831839287955711419276758421408746",
"105505799168464710420867614201890732365",
"175403990623646694609496918373660659433",
"287695651654782542321942978032014658416",
"300331214421486019887837944356144402683",
"138086028348550129822977356105290392467",
"80917660284909545533969864048256494008"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-2dbb24b4",
"target": {
"file": "http-server/src/main/java/io/micronaut/http/server/cors/CorsOriginConverter.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "290766458588122183411060301807602864397"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-2fb62fb5",
"target": {
"function": "handleResponse",
"file": "http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 265.0,
"function_hash": "251010071982009332539151143694869764818"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-3572dbb1",
"target": {
"function": "DefaultArgument",
"file": "core/src/main/java/io/micronaut/core/type/DefaultArgument.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"271309775470687507892562322611372123626",
"159688232355749724108758364805336828249",
"260406165262547003159248191199975022429",
"224490071308930739445388707034122006880",
"308356184769270864844070604667218073478",
"271086141076239634300620422682516623427",
"317349542856197309288802966767476253348",
"314435486390360535430394648925210645980",
"123577494548505670805781407548279188540",
"168978863174131812530615703331135437793",
"281616101742749243787271487666749019346",
"237304889635709638506480796686329576920",
"256463382387543226264183930503754548606"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-3a7af7fa",
"target": {
"file": "core/src/main/java/io/micronaut/core/convert/DefaultArgumentConversionContext.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1292.0,
"function_hash": "120191643513809905960056823697128209599"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-4123598d",
"target": {
"function": "handleRequest",
"file": "http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"201465539336609143461239945123308456954",
"171462305189364804758989281169497642728",
"148466307909572446208803723480125197437",
"135693037319301767325993999518947369908",
"268962308848200300926866410206080952497",
"274854047471466622782823788607526622206",
"228922782878713439968401604117527060684",
"239899538153261439615710911518002515223",
"37469526084090439720601546514693457852",
"192470326465033462762382467556923186963",
"224661018434167949191612451904221194417",
"106897259783304035081674849605333934511",
"317177122604229869032771017659759964010",
"8391649912795857719251791533891334276",
"197461162188356944006249291131145819327",
"132536603122489900051070933758188520207",
"300349406962788774120241325532153490936",
"331129890078720123858584302945401523666",
"229889965950747922422715728447137652297",
"125441759504693406765285398929176845584",
"203290008154968943668473827779534844216",
"322833226801178057770153699406559867100",
"152270057239150580272984585393095393054",
"126204006029517719318003148536284499640"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-42e4c239",
"target": {
"file": "core/src/main/java/io/micronaut/core/type/Argument.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"105184560128589234593715573098860390170",
"237353716863080609786597243097083851066",
"124099034873772790977605726077085694478"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-4704f276",
"target": {
"file": "core/src/main/java/io/micronaut/core/convert/ConversionContext.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 69.0,
"function_hash": "33962196079323967006762823283080630408"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-48712cf3",
"target": {
"function": "argumentType",
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/CompletableFutureBodyBinder.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"307154821012836805440332141262031068480",
"20395682466546675787739041727873077373",
"324145059320879723844350634826756011908",
"192880460882676084642356284188854779839"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-4a81c7ca",
"target": {
"file": "http-client/src/main/java/io/micronaut/http/client/exceptions/HttpClientErrorDecoder.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57596284507037723816659258590636135285",
"144032751279566853974117074748957056016",
"294291372396290638596130468455291617498",
"92220027765685787977841630506876317385",
"128797912565599707752845636341873182463",
"60054157032893007314468293702123173358",
"155777743867428052785865977151386020761"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-50e5b2b3",
"target": {
"file": "http/src/main/java/io/micronaut/http/MediaType.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"198963050687624000931166593363437527627",
"232231613210873617557430666153777597920",
"264952276315303940656843094562652667599",
"266243601785677486267433593961949687784",
"8958517847149324020455829955524122656",
"168330545939999708782980308920525476924",
"334482125978904884162460955644748628314",
"137357228748296511110482076670306757240",
"54279786242083335360543639564038026780",
"192222291175171855973877283596455428334",
"152371088151510962921768965511589401517",
"29292509470253861194388051260439136318"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-5a58ab1d",
"target": {
"file": "core/src/main/java/io/micronaut/core/type/DefaultArgument.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1609.0,
"function_hash": "166372039010027891723999512959614556916"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-60f002e6",
"target": {
"function": "buildCacheablePublisher",
"file": "runtime/src/main/java/io/micronaut/cache/interceptor/CacheInterceptor.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166341302776835418669382937043019592630",
"64445547335545039498493898068217571587",
"317915129536781034255187680824183166531",
"11366378875667287479671906647899371786"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-6f94ac94",
"target": {
"file": "core/src/main/java/io/micronaut/core/convert/value/ConvertibleMultiValues.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 884.0,
"function_hash": "238312363636237514537894807835805231774"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-82c2b775",
"target": {
"function": "convert",
"file": "http-server/src/main/java/io/micronaut/http/server/cors/CorsOriginConverter.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"259300287667930662196486456143690993903",
"93414863766209437266942279987954057516",
"157108358748287829638724845384678902221",
"318748391714910986887462904705479821593",
"112762774371464505230859528809489074526",
"266956291616473401540789293312934993613",
"329615229558016130675331680459936213280"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-8a4cfa8b",
"target": {
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/CompletableFutureBodyBinder.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"102545523924664580037849546805604070964",
"237668822486050520764831538336652892683",
"252035491441352698352175826509858256397",
"57057451805401724027395692800293486315",
"332092505947049607644011113507159429140",
"161398393836591168208030952177810029858",
"178390897151021187601926710190666586851",
"215406048713739473298036964837227028137"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-8b230182",
"target": {
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/PublisherBodyBinder.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"192142767736710290643357400771164202661",
"212742831227063920532997405919709642762",
"18695055729909607629360799584283738136",
"337004061370340026787283133577686937320",
"227991857311392539388154671234847129857",
"236608610744878944056567764847933306655",
"237224697332848823997119448680926449756",
"254488847129652947472927052658319170155"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-8f070458",
"target": {
"file": "runtime/src/main/java/io/micronaut/cache/interceptor/CacheInterceptor.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 69.0,
"function_hash": "33962196079323967006762823283080630408"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-92ebce8c",
"target": {
"function": "argumentType",
"file": "session/src/main/java/io/micronaut/session/binder/SessionArgumentBinder.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"294035979660799046579945258992000810764",
"256626696820107283624415308809253479557",
"201510418544882296686814016186641778110",
"39781367810668983073725470889858277496",
"247395672664947025497355524979423929703",
"105292544852500172901660821113615189639",
"68342560848219701463610674083523883564",
"99376022218269190915489395115416098956",
"23263081962088732080610046323548494276",
"45175850438880620791999592376588172423",
"116964459743440055046293990481096005680",
"247810947647188801155375286684805444890",
"97688445437540631266628629865898233761",
"68909346328221875815141798234299702629",
"253526204338505212432425893195652668055",
"241448135640000597471951867780958705516",
"137122023986813541513648176413786490309",
"173515096274594366633453431957149628669",
"328688690894544176923466075791871076526",
"137202290469222435783951532600348081446",
"76677639988374932446070201773341936437",
"60160233118162963002963222870247256955",
"203634507226078681250488165213661228622",
"21441399789830915522830428230456792256",
"323386059363024102147032097114380369630"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-951b6b52",
"target": {
"file": "http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 626.0,
"function_hash": "165517805502432814994317610612659664698"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-a05073db",
"target": {
"function": "matches",
"file": "runtime/src/main/java/io/micronaut/scheduling/io/watch/FileWatchCondition.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"176960889575143321512093913522515784120",
"136774641414801614702554730734855953350",
"173143505903380567298819077959566557032",
"273799317546313021433069638948332704311",
"160779666993178806526517491675014683143",
"30511814116333299656588403811253757146",
"25445420978873844662366935567034320595"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-a333d76e",
"target": {
"file": "session/src/main/java/io/micronaut/session/binder/SessionArgumentBinder.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3376.0,
"function_hash": "68702291797273342173616576690482777086"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-bd71a786",
"target": {
"function": "doOnNext",
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/RoutingInBoundHandler.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 6500.0,
"function_hash": "131920773700437597800897020373593286042"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-dad391aa",
"target": {
"function": "buildSubscriber",
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/RoutingInBoundHandler.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"94204221699041982712895183799261764351",
"143397852709261557728482223505301177871",
"117857250194090999470000478052767282492",
"79064211733768179121898861623591852647",
"263183202612183078044460326859733303552",
"165047845556110042483548745652606227250",
"279779025716401367809690812838310216539",
"271215771634842852994029852319555571423",
"166386901614856011571946373154452464605",
"47485894811281360132917425314268121310",
"12617256256390718762904092103656565524",
"211298008714037339332740546348730736053",
"157467221174029116751426308374837953981",
"317839095316382518489222130815130518069",
"185214142736354278260159902851607610681",
"130344922885447112048165081028501555032",
"235011249237205858904764468118892694299",
"213456624145890717936373500920785224696",
"89290678744938360647954703533221194797",
"272624694846585405754062116650375425849",
"151259517156431204498057092478706647496",
"325101847773252230598311191624028890954"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-ddbf555c",
"target": {
"file": "http/src/main/java/io/micronaut/http/HttpHeaders.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 69.0,
"function_hash": "33962196079323967006762823283080630408"
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-e51baf2f",
"target": {
"function": "argumentType",
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/PublisherBodyBinder.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"76523713440164130123002449489296901917",
"15985788913752750972557529934161827060",
"262271145097385601246039172393853328431",
"232484214926884175143374286232387622898"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-ece6efbc",
"target": {
"file": "core/src/main/java/io/micronaut/core/convert/value/ConvertibleValues.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"141857058093667193807821233696940550384",
"170801467742038403018492147594016453631",
"149448964771632019812087691470466557740",
"160084892044603544385784086083074749935",
"153415632521400208753454147337436264402",
"282699968476401200798742462996874521974",
"272613888158380829528653262571858627564",
"203259308094343678231055965468333735455",
"38215658627557966450957720935061955217",
"309105410685146406307230727651567544823",
"18349057319015924496268189324090512762",
"99872614211135662715362492180120593718"
]
},
"signature_version": "v1",
"source": "https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3",
"id": "CVE-2022-21700-f1fd4e42",
"target": {
"file": "http-server-netty/src/main/java/io/micronaut/http/server/netty/RoutingInBoundHandler.java"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21700.json"