eclipse-vertx / eclipse-vertx/vert.x

Multipart decoder retention on abort/reset/exception paths

Open
#6,014 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
14.7k
Forks
2.1k
Avg merge
2d 7h
Merged PRs (30d)
28

Description

### Version

5.0.x

### Context

While looking into multipart abort/reset handling, I noticed that multipart decoders can remain retained on exception/reset/close paths instead of being cleaned up like on normal completion.

I reproduced this by sending incomplete `multipart/form-data` requests and closing the connection before the final boundary. In my PoC, terminal decoders remained retained for more than 30 seconds after traffic stopped.

The previous discussion and PoC details are here:
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/370

### Steps to reproduce

1. Run a simple Vert.x HTTP server with a `POST /upload` endpoint that calls `setExpectMultipart(true)`.
2. Send many incomplete `multipart/form-data` requests and close the connection before the final boundary.
3. Observe that decoder instances can remain retained on terminal paths for an extended time.

### Do you have a reproducer?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.