Detections
Analytics

SCA: security update for io.micronaut:micronaut-http (GHSA-2457-2263-mm9f)

medium Tenable Self-Hosted Container Security Plugin ID 408659

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with
 support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type
 header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static
 state. ### Impact Sending an invalid Content Type header leads to memory leak in
 `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The
 problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be
 replaced in an existing Micronaut application to mitigate the issue: ```java package example; import
 java.util.List; import io.micronaut.context.annotation.Replaces; import
 io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import
 io.micronaut.http.bind.DefaultRequestBinderRegistry; import
 io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton
 @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends
 DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionService,
 List<RequestArgumentBinder> binders) { super(conversionService, binders); } @Override protected void
 registerDefaultConverters(ConversionService<?> conversionService) {
 super.registerDefaultConverters(conversionService); conversionService.addConverter(CharSequence.class,
 MediaType.class, charSequence -> { try { return MediaType.of(charSequence); } catch
 (IllegalArgumentException e) { return null; } }); } } ``` ### References Commit that introduced the
 vulnerability https://github.com/micronaut-projects/micronaut-
 core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3 ### For more information If you have any questions or
 comments about this advisory: * Open an issue in [Micronaut Core](https://github.com/micronaut-
 projects/micronaut-core/issues) * Email us at [[email protected]](mailto:[email protected])
 (CVE-2022-21700)

See Also

https://github.com/advisories/GHSA-2457-2263-mm9f

Plugin Details

Severity: Medium

ID: 408659

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-21700

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/21/2022

Vulnerability Publication Date: 1/18/2022

Reference Information

CVE: CVE-2022-21700

cwe: CWE-400