Multipart decoder retention on abort/reset/exception paths

[shblue21]

Version

5.0.x

Context

While looking into multipart abort/reset handling, I noticed that multipart decoders can remain retained on exception/reset/close paths instead of being cleaned up like on normal completion.

I reproduced this by sending incomplete multipart/form-data requests and closing the connection before the final boundary. In my PoC, terminal decoders remained retained for more than 30 seconds after traffic stopped.

The previous discussion and PoC details are here:

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/370

Steps to reproduce

1. Run a simple Vert.x HTTP server with a POST /upload endpoint that calls setExpectMultipart(true).
2. Send many incomplete multipart/form-data requests and close the connection before the final boundary.
3. Observe that decoder instances can remain retained on terminal paths for an extended time.

Do you have a reproducer?

No response

[Kapil-chn7]

Hi @shblue21,

I'm new to Eclipse Vert.x and open-source contributions, but I'd like to work on this bug. I’ll try to reproduce the issue on my local system first and then investigate a possible solution.

If no one else is currently working on it, could you please assign it to me?

Thanks

[vietj]

we cannot assign persons not member of the project on an issue, so you can contribute it and I think it's enough to state it here