Thomas-Read

An unbounded per-connection queue growth flaw exists in the `HttpServerCodec`. The codec tracks the HTTP method of unanswered pipelined requests; while the first 32 entries are bit-packed into a single long, subsequent entries are added to the `methodOverflowQueue` (an `ArrayDeque` with no size limit or rejection path). A remote, unauthenticated attacker can exploit this by pipelining HTTP/1.1 requests on a single connection and withholding reads to prevent responses from being flushed. This action allows the queue to grow without bound, leading to unbounded heap growth and a denial of service.

A ByteBuf leak exists in the `StompSubframeDecoder` function. When a frame's declared content-length is fully read, the decoder allocates a chunk buffer and waits for the terminating NUL byte. If this byte is not received, the buffer is not released because the signal thrown by `skipNullCharacter()` extends Error instead of Exception, bypassing the release path. Additionally, the decoder does not override `handlerRemoved0` or `channelInactive`, allowing the buffer to persist after channel teardown. A remote peer can trigger this leak by sending a well-formed frame body without the terminating NUL byte, potentially leading to memory exhaustion as the pooled allocator does not reclaim the memory.