{"id":"CVE-2022-21700","summary":"Memory leak in micronaut-core","details":"Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: ```java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionService, List\u003cRequestArgumentBinder\u003e binders) { super(conversionService, binders); } @Override protected void registerDefaultConverters(ConversionService\u003c?\u003e conversionService) { super.registerDefaultConverters(conversionService); conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -\u003e { try { return MediaType.of(charSequence); } catch (IllegalArgumentException e) { return null; } }); } } ``` ### References Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues) * Email us at [info@micronaut.io](mailto:info@micronaut.io)","aliases":["GHSA-2457-2263-mm9f"],"modified":"2026-08-12T12:59:51.222416Z","published":"2022-01-18T22:15:13Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21700.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21700.json"},{"type":"ADVISORY","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2457-2263-mm9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21700"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/micronaut-projects/micronaut-core","events":[{"introduced":"0"},{"fixed":"cc909a6a908fba94efea5499ea77e76f018640f1"},{"fixed":"b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3"}],"database_specific":{"cpe":"cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.2.7"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v3.2.6","v3.2.5","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.0","v3.0.0","v3.0.0-RC1","v3.0.0-M5","v3.0.0-M4","v3.0.0-M2","v2.0.1","v2.0.0","v2.0.0.RC2","v2.0.0.RC1","v1.3.0","v1.3.0.RC1","v1.3.0.M2","v1.3.0.TEST","v1.3.0.M1","v1.2.6","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.2.0.RC2","v1.2.0.RC1","v1.1.0.RC2","v1.1.0.RC1","v1.1.0.M2","v1.1.0.M1","v1.0.0","v1.0.0.RC3","v1.0.0.RC2","v1.0.0.M4","v1.0.0.M3","v1.0.0.M2","v1.0.0.M1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21700.json","vanir_signatures_modified":"2026-08-12T12:59:51Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"179729363634450903841203688127508465856","length":1627},"id":"CVE-2022-21700-05809ec1","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"runtime/src/main/java/io/micronaut/cache/interceptor/CacheInterceptor.java","function":"interceptCompletableFuture"}},{"target":{"file":"runtime/src/main/java/io/micronaut/scheduling/io/watch/FileWatchCondition.java"},"deprecated":false,"digest":{"line_hashes":["78935825455436841503059314843993633405","145238824509455889187724355634989577557","304962170422502154275805257258483125491","230504336565015093592834742948125019183","316621431223870261625585615733240583197","92541995954499670664010925737979018796","64257053902510226749540960314361790168","287137858923541255310235755974690671110"],"threshold":0.9},"id":"CVE-2022-21700-1df9fb43","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3"},{"deprecated":false,"digest":{"line_hashes":["165536524519270508417881441700869052018","142657983372128563254849207186145624034","270638800381323418472767245618961938045","237568950901803829800281097988904629746","141384450288324898046324590223553730722","233592204888616913154630188247363926704","113149346973378163435179105190407078679","264758150493450629763962489307713002231","233214630440653146368731806723724767952","67249362822052508073230889565835693473","42338520502450488518030570394526915329","20351184042760053239345146620604686504","170692909519453216332391493318327643984","274171838795309329269448330952743128704","319441743336684755531369680969860578147","277812548910399084845861400948480672329","237806335378713865789279582794128811445","326424764918315152317209685983235475459","325104140562350316825741215890753711486","299984275478450902609568408899266165284","329969831839287955711419276758421408746","105505799168464710420867614201890732365","175403990623646694609496918373660659433","287695651654782542321942978032014658416","300331214421486019887837944356144402683","138086028348550129822977356105290392467","80917660284909545533969864048256494008"],"threshold":0.9},"id":"CVE-2022-21700-2dbb24b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server/src/main/java/io/micronaut/http/server/cors/CorsOriginConverter.java"}},{"deprecated":false,"digest":{"function_hash":"290766458588122183411060301807602864397","length":766},"id":"CVE-2022-21700-2fb62fb5","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java","function":"handleResponse"}},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/type/DefaultArgument.java","function":"DefaultArgument"},"deprecated":false,"digest":{"function_hash":"251010071982009332539151143694869764818","length":265},"id":"CVE-2022-21700-3572dbb1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/convert/DefaultArgumentConversionContext.java"},"deprecated":false,"digest":{"line_hashes":["271309775470687507892562322611372123626","159688232355749724108758364805336828249","260406165262547003159248191199975022429","224490071308930739445388707034122006880","308356184769270864844070604667218073478","271086141076239634300620422682516623427","317349542856197309288802966767476253348","314435486390360535430394648925210645980","123577494548505670805781407548279188540","168978863174131812530615703331135437793","281616101742749243787271487666749019346","237304889635709638506480796686329576920","256463382387543226264183930503754548606"],"threshold":0.9},"id":"CVE-2022-21700-3a7af7fa","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"120191643513809905960056823697128209599","length":1292},"id":"CVE-2022-21700-4123598d","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java","function":"handleRequest"}},{"id":"CVE-2022-21700-42e4c239","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/type/Argument.java"},"deprecated":false,"digest":{"line_hashes":["201465539336609143461239945123308456954","171462305189364804758989281169497642728","148466307909572446208803723480125197437","135693037319301767325993999518947369908","268962308848200300926866410206080952497","274854047471466622782823788607526622206","228922782878713439968401604117527060684","239899538153261439615710911518002515223","37469526084090439720601546514693457852","192470326465033462762382467556923186963","224661018434167949191612451904221194417","106897259783304035081674849605333934511","317177122604229869032771017659759964010","8391649912795857719251791533891334276","197461162188356944006249291131145819327","132536603122489900051070933758188520207","300349406962788774120241325532153490936","331129890078720123858584302945401523666","229889965950747922422715728447137652297","125441759504693406765285398929176845584","203290008154968943668473827779534844216","322833226801178057770153699406559867100","152270057239150580272984585393095393054","126204006029517719318003148536284499640"],"threshold":0.9}},{"id":"CVE-2022-21700-4704f276","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/convert/ConversionContext.java"},"deprecated":false,"digest":{"line_hashes":["105184560128589234593715573098860390170","237353716863080609786597243097083851066","124099034873772790977605726077085694478"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/CompletableFutureBodyBinder.java","function":"argumentType"},"deprecated":false,"digest":{"function_hash":"33962196079323967006762823283080630408","length":69},"id":"CVE-2022-21700-48712cf3"},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-client/src/main/java/io/micronaut/http/client/exceptions/HttpClientErrorDecoder.java"},"deprecated":false,"digest":{"line_hashes":["307154821012836805440332141262031068480","20395682466546675787739041727873077373","324145059320879723844350634826756011908","192880460882676084642356284188854779839"],"threshold":0.9},"id":"CVE-2022-21700-4a81c7ca","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["57596284507037723816659258590636135285","144032751279566853974117074748957056016","294291372396290638596130468455291617498","92220027765685787977841630506876317385","128797912565599707752845636341873182463","60054157032893007314468293702123173358","155777743867428052785865977151386020761"]},"id":"CVE-2022-21700-50e5b2b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http/src/main/java/io/micronaut/http/MediaType.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["198963050687624000931166593363437527627","232231613210873617557430666153777597920","264952276315303940656843094562652667599","266243601785677486267433593961949687784","8958517847149324020455829955524122656","168330545939999708782980308920525476924","334482125978904884162460955644748628314","137357228748296511110482076670306757240","54279786242083335360543639564038026780","192222291175171855973877283596455428334","152371088151510962921768965511589401517","29292509470253861194388051260439136318"],"threshold":0.9},"id":"CVE-2022-21700-5a58ab1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/type/DefaultArgument.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"runtime/src/main/java/io/micronaut/cache/interceptor/CacheInterceptor.java","function":"buildCacheablePublisher"},"deprecated":false,"digest":{"function_hash":"166372039010027891723999512959614556916","length":1609},"id":"CVE-2022-21700-60f002e6"},{"deprecated":false,"digest":{"line_hashes":["166341302776835418669382937043019592630","64445547335545039498493898068217571587","317915129536781034255187680824183166531","11366378875667287479671906647899371786"],"threshold":0.9},"id":"CVE-2022-21700-6f94ac94","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/convert/value/ConvertibleMultiValues.java"}},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server/src/main/java/io/micronaut/http/server/cors/CorsOriginConverter.java","function":"convert"},"deprecated":false,"digest":{"function_hash":"238312363636237514537894807835805231774","length":884},"id":"CVE-2022-21700-82c2b775","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/CompletableFutureBodyBinder.java"},"deprecated":false,"digest":{"line_hashes":["259300287667930662196486456143690993903","93414863766209437266942279987954057516","157108358748287829638724845384678902221","318748391714910986887462904705479821593","112762774371464505230859528809489074526","266956291616473401540789293312934993613","329615229558016130675331680459936213280"],"threshold":0.9},"id":"CVE-2022-21700-8a4cfa8b"},{"deprecated":false,"digest":{"line_hashes":["102545523924664580037849546805604070964","237668822486050520764831538336652892683","252035491441352698352175826509858256397","57057451805401724027395692800293486315","332092505947049607644011113507159429140","161398393836591168208030952177810029858","178390897151021187601926710190666586851","215406048713739473298036964837227028137"],"threshold":0.9},"id":"CVE-2022-21700-8b230182","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/PublisherBodyBinder.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"runtime/src/main/java/io/micronaut/cache/interceptor/CacheInterceptor.java"},"deprecated":false,"digest":{"line_hashes":["192142767736710290643357400771164202661","212742831227063920532997405919709642762","18695055729909607629360799584283738136","337004061370340026787283133577686937320","227991857311392539388154671234847129857","236608610744878944056567764847933306655","237224697332848823997119448680926449756","254488847129652947472927052658319170155"],"threshold":0.9},"id":"CVE-2022-21700-8f070458"},{"deprecated":false,"digest":{"function_hash":"33962196079323967006762823283080630408","length":69},"id":"CVE-2022-21700-92ebce8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"session/src/main/java/io/micronaut/session/binder/SessionArgumentBinder.java","function":"argumentType"}},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java"},"deprecated":false,"digest":{"line_hashes":["294035979660799046579945258992000810764","256626696820107283624415308809253479557","201510418544882296686814016186641778110","39781367810668983073725470889858277496","247395672664947025497355524979423929703","105292544852500172901660821113615189639","68342560848219701463610674083523883564","99376022218269190915489395115416098956","23263081962088732080610046323548494276","45175850438880620791999592376588172423","116964459743440055046293990481096005680","247810947647188801155375286684805444890","97688445437540631266628629865898233761","68909346328221875815141798234299702629","253526204338505212432425893195652668055","241448135640000597471951867780958705516","137122023986813541513648176413786490309","173515096274594366633453431957149628669","328688690894544176923466075791871076526","137202290469222435783951532600348081446","76677639988374932446070201773341936437","60160233118162963002963222870247256955","203634507226078681250488165213661228622","21441399789830915522830428230456792256","323386059363024102147032097114380369630"],"threshold":0.9},"id":"CVE-2022-21700-951b6b52","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"165517805502432814994317610612659664698","length":626},"id":"CVE-2022-21700-a05073db","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"runtime/src/main/java/io/micronaut/scheduling/io/watch/FileWatchCondition.java","function":"matches"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"session/src/main/java/io/micronaut/session/binder/SessionArgumentBinder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["176960889575143321512093913522515784120","136774641414801614702554730734855953350","173143505903380567298819077959566557032","273799317546313021433069638948332704311","160779666993178806526517491675014683143","30511814116333299656588403811253757146","25445420978873844662366935567034320595"]},"id":"CVE-2022-21700-a333d76e"},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"function":"doOnNext","file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/RoutingInBoundHandler.java"},"deprecated":false,"digest":{"function_hash":"68702291797273342173616576690482777086","length":3376},"id":"CVE-2022-21700-bd71a786","signature_type":"Function","signature_version":"v1"},{"target":{"function":"buildSubscriber","file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/RoutingInBoundHandler.java"},"deprecated":false,"digest":{"function_hash":"131920773700437597800897020373593286042","length":6500},"id":"CVE-2022-21700-dad391aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3"},{"digest":{"threshold":0.9,"line_hashes":["94204221699041982712895183799261764351","143397852709261557728482223505301177871","117857250194090999470000478052767282492","79064211733768179121898861623591852647","263183202612183078044460326859733303552","165047845556110042483548745652606227250","279779025716401367809690812838310216539","271215771634842852994029852319555571423","166386901614856011571946373154452464605","47485894811281360132917425314268121310","12617256256390718762904092103656565524","211298008714037339332740546348730736053","157467221174029116751426308374837953981","317839095316382518489222130815130518069","185214142736354278260159902851607610681","130344922885447112048165081028501555032","235011249237205858904764468118892694299","213456624145890717936373500920785224696","89290678744938360647954703533221194797","272624694846585405754062116650375425849","151259517156431204498057092478706647496","325101847773252230598311191624028890954"]},"id":"CVE-2022-21700-ddbf555c","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http/src/main/java/io/micronaut/http/HttpHeaders.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/binders/PublisherBodyBinder.java","function":"argumentType"},"deprecated":false,"digest":{"function_hash":"33962196079323967006762823283080630408","length":69},"id":"CVE-2022-21700-e51baf2f","signature_type":"Function"},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"core/src/main/java/io/micronaut/core/convert/value/ConvertibleValues.java"},"deprecated":false,"digest":{"line_hashes":["76523713440164130123002449489296901917","15985788913752750972557529934161827060","262271145097385601246039172393853328431","232484214926884175143374286232387622898"],"threshold":0.9},"id":"CVE-2022-21700-ece6efbc","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["141857058093667193807821233696940550384","170801467742038403018492147594016453631","149448964771632019812087691470466557740","160084892044603544385784086083074749935","153415632521400208753454147337436264402","282699968476401200798742462996874521974","272613888158380829528653262571858627564","203259308094343678231055965468333735455","38215658627557966450957720935061955217","309105410685146406307230727651567544823","18349057319015924496268189324090512762","99872614211135662715362492180120593718"],"threshold":0.9},"id":"CVE-2022-21700-f1fd4e42","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3","target":{"file":"http-server-netty/src/main/java/io/micronaut/http/server/netty/RoutingInBoundHandler.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}