CVE-2022-21700 is a vulnerability classified under CWE-400 (Uncontrolled Resource Consumption) affecting the Micronaut Core framework, a JVM-based full-stack Java framework widely used for building web applications in Java, Kotlin, and Groovy. The vulnerability arises from improper handling of the Content-Type HTTP header in affected versions of Micronaut Core prior to 3.2.7. Specifically, when an invalid Content-Type header is sent in a request, the framework's DefaultArgumentConversionContext erroneously stores this invalid type in a static state, leading to a memory leak. This uncontrolled memory consumption can degrade application performance and potentially cause denial of service (DoS) conditions due to resource exhaustion. The root cause is the static retention of invalid Content-Type objects, which accumulate over time as malformed requests are processed. The issue was introduced in a recent commit and has been addressed in Micronaut Core version 3.2.7 and later. A workaround is available that involves replacing the default content type binder with a custom implementation that safely handles invalid Content-Type headers by returning null instead of storing invalid values, thereby preventing the memory leak. This workaround requires modifying the application code to override the DefaultRequestBinderRegistry with a safer converter for MediaType. No known exploits are reported in the wild, but the vulnerability poses a risk in environments where untrusted or malformed HTTP requests can be sent to Micronaut-based services. Given the framework's use in JVM web applications, this vulnerability can affect a broad range of enterprise and cloud-native applications that rely on Micronaut for HTTP request processing.

For European organizations, the impact of CVE-2022-21700 can be significant, especially for those deploying web applications or microservices using vulnerable versions of Micronaut Core. The memory leak caused by malformed Content-Type headers can lead to gradual resource exhaustion, resulting in degraded application performance, increased latency, and potential service outages. This can disrupt business operations, customer-facing services, and internal applications. Organizations in sectors such as finance, healthcare, telecommunications, and public administration, which often deploy JVM-based applications at scale, may experience operational disruptions or increased costs due to the need for additional monitoring and mitigation efforts. Furthermore, if exploited in a targeted manner, attackers could induce denial of service conditions, impacting availability and potentially causing reputational damage. While the vulnerability does not directly lead to data breaches or code execution, the availability impact alone can be critical for high-availability services. The lack of authentication or user interaction requirements means that any external attacker capable of sending HTTP requests can trigger the memory leak, increasing the attack surface. Given the widespread adoption of Micronaut in cloud-native and microservice architectures, the scope of affected systems can be broad within European enterprises leveraging modern Java frameworks.

To mitigate CVE-2022-21700, European organizations should prioritize upgrading all Micronaut Core dependencies to version 3.2.7 or later, where the vulnerability is patched. For applications where immediate upgrading is not feasible, implement the provided workaround by replacing the default content type binder with a custom binder that safely handles invalid Content-Type headers, as demonstrated in the advisory's sample Java code. This involves overriding the DefaultRequestBinderRegistry and adding a converter that returns null upon encountering invalid media types, preventing the memory leak. Additionally, organizations should implement strict input validation and filtering at the web application firewall (WAF) or API gateway level to block malformed or suspicious Content-Type headers before they reach the application. Monitoring application memory usage and setting up alerts for abnormal growth patterns can help detect exploitation attempts early. Incorporating rate limiting on incoming requests can reduce the risk of resource exhaustion attacks. Finally, conducting code reviews and dependency audits to identify and update vulnerable libraries across the software supply chain is recommended to prevent similar issues.