eclipse-vertx / eclipse-vertx/vert.x
Multipart decoder retention on abort/reset/exception paths
- Dominant language
- Java
- Stars
- 14.7k
- Forks
- 2.1k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 28
Description
### Version
5.0.x
### Context
While looking into multipart abort/reset handling, I noticed that multipart decoders can remain retained on exception/reset/close paths instead of being cleaned up like on normal completion.
I reproduced this by sending incomplete `multipart/form-data` requests and closing the connection before the final boundary. In my PoC, terminal decoders remained retained for more than 30 seconds after traffic stopped.
The previous discussion and PoC details are here:
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/370
### Steps to reproduce
1. Run a simple Vert.x HTTP server with a `POST /upload` endpoint that calls `setExpectMultipart(true)`.
2. Send many incomplete `multipart/form-data` requests and close the connection before the final boundary.
3. Observe that decoder instances can remain retained on terminal paths for an extended time.
### Do you have a reproducer?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.