Multipart upload leak on client abort (ByteBuf.release() not called)

[dmittriy13]

Description

I see Netty leak reports during multipart uploads when the client aborts the request mid‑upload. Leak detector logs point to the inbound HTTP pipeline / multipart parsing path. This reproduces quickly when the client timeout is small and the
uploaded files are large.

Environment

• OS: Linux
• JDK: 21
• Spring Boot: 3.5.10
• Spring Framework: 6.x (from Boot 3.5.10 BOM)
• Reactor Netty: 1.2.14
• Netty: 4.1.130.Final
• Leak detection:
  -Dio.netty.leakDetection.level=advanced (also tried paranoid)
  -Dio.netty.leakDetection.targetRecords=32
  -Dio.netty.leakDetection.samplingInterval=64

Dependencies (relevant)

org.springframework.boot:spring-boot-starter-reactor-netty:3.5.10
└─ io.projectreactor.netty:reactor-netty-http:1.2.14
├─ io.netty:netty-codec-http:4.1.130.Final
├─ io.netty:netty-buffer:4.1.130.Final
├─ io.netty:netty-transport:4.1.130.Final
├─ io.netty:netty-handler:4.1.130.Final
└─ io.projectreactor.netty:reactor-netty-core:1.2.14

Reproduction

Minimal repro project:
https://github.com/dmittriy13/webflux-multipart-leak-repro

Summary of steps:

1. Start the app.
2. Run k6 load test with a short client timeout so requests are aborted mid‑upload.
3. Observe leak logs.

Expected behavior

No ByteBuf leak reports on client abort. Inbound buffers should be released even if the request is cancelled.

Actual behavior

Leak logs appear immediately after client abort. Example:

Full leak stack trace

2026-02-05T09:56:34.932Z ERROR 1 --- [r-http-epoll-13] io.netty.util.ResourceLeakDetector : LEAK: ByteBuf.release() was not called before it's garbage-collected. See https://netty.io/wiki/reference-counted-objects.html for more
information.
app-1 | Recent access records:
app-1 | #1:
app-1 | io.netty.handler.codec.http.DefaultHttpContent.release(DefaultHttpContent.java:92)
app-1 | io.netty.util.ReferenceCountUtil.release(ReferenceCountUtil.java:90)
app-1 | reactor.netty.channel.FluxReceive.drainReceiver(FluxReceive.java:296)
app-1 | reactor.netty.channel.FluxReceive.lambda$request$1(FluxReceive.java:136)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:405)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)
app-1 | #2:
app-1 | io.netty.buffer.AdvancedLeakAwareByteBuf.forEachByte(AdvancedLeakAwareByteBuf.java:677)
app-1 | org.springframework.core.io.buffer.NettyDataBuffer.forEachByte(NettyDataBuffer.java:134)
app-1 | org.springframework.core.io.buffer.DataBufferUtils$AbstractNestedMatcher.match(DataBufferUtils.java:882)
app-1 | org.springframework.http.codec.multipart.MultipartParser$BodyState.onNext(MultipartParser.java:522)
app-1 | org.springframework.http.codec.multipart.MultipartParser.hookOnNext(MultipartParser.java:123)
app-1 | org.springframework.http.codec.multipart.MultipartParser.hookOnNext(MultipartParser.java:52)
app-1 | reactor.core.publisher.BaseSubscriber.onNext(BaseSubscriber.java:160)
app-1 | reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:122)
app-1 | reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:200)
app-1 | reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:122)
app-1 | reactor.netty.channel.FluxReceive.drainReceiver(FluxReceive.java:292)
app-1 | reactor.netty.channel.FluxReceive.lambda$request$1(FluxReceive.java:136)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:405)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)
app-1 | #3:
app-1 | org.springframework.core.io.buffer.NettyDataBufferFactory.wrap(NettyDataBufferFactory.java:94)
app-1 | reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:106)
app-1 | reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:200)
app-1 | reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:122)
app-1 | reactor.netty.channel.FluxReceive.drainReceiver(FluxReceive.java:292)
app-1 | reactor.netty.channel.FluxReceive.lambda$request$1(FluxReceive.java:136)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:405)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)
app-1 | #4:
app-1 | reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:185)
app-1 | reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:122)
app-1 | reactor.netty.channel.FluxReceive.drainReceiver(FluxReceive.java:292)
app-1 | reactor.netty.channel.FluxReceive.lambda$request$1(FluxReceive.java:136)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
app-1 | io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:405)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)
app-1 | #5:
app-1 | Hint: 'reactor.right.reactiveBridge' will handle the message from this point.
app-1 | io.netty.handler.codec.http.DefaultHttpContent.touch(DefaultHttpContent.java:86)
app-1 | io.netty.handler.codec.http.DefaultHttpContent.touch(DefaultHttpContent.java:25)
app-1 | io.netty.channel.DefaultChannelPipeline.touch(DefaultChannelPipeline.java:115)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:417)
app-1 | io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
app-1 | reactor.netty.http.server.HttpTrafficHandler.channelRead(HttpTrafficHandler.java:326)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
app-1 | io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:361)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:325)
app-1 | io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
app-1 | io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
app-1 | io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:805)
app-1 | io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:501)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:399)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)
app-1 | #6:
app-1 | Hint: 'reactor.left.httpTrafficHandler' will handle the message from this point.
app-1 | io.netty.handler.codec.http.DefaultHttpContent.touch(DefaultHttpContent.java:86)
app-1 | io.netty.handler.codec.http.DefaultHttpContent.touch(DefaultHttpContent.java:25)
app-1 | io.netty.channel.DefaultChannelPipeline.touch(DefaultChannelPipeline.java:115)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:417)
app-1 | io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
app-1 | io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:361)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:325)
app-1 | io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
app-1 | io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
app-1 | io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:805)
app-1 | io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:501)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:399)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)
app-1 | Created at:
app-1 | io.netty.buffer.SimpleLeakAwareByteBuf.unwrappedDerived(SimpleLeakAwareByteBuf.java:144)
app-1 | io.netty.buffer.SimpleLeakAwareByteBuf.readRetainedSlice(SimpleLeakAwareByteBuf.java:67)
app-1 | io.netty.buffer.AdvancedLeakAwareByteBuf.readRetainedSlice(AdvancedLeakAwareByteBuf.java:108)
app-1 | io.netty.handler.codec.http.HttpObjectDecoder.decode(HttpObjectDecoder.java:459)
app-1 | io.netty.handler.codec.http.HttpServerCodec$HttpServerRequestDecoder.decode(HttpServerCodec.java:167)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:545)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:484)
app-1 | io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:296)
app-1 | io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
app-1 | io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
app-1 | io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
app-1 | io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
app-1 | io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:805)
app-1 | io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:501)
app-1 | io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:399)
app-1 | io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
app-1 | io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
app-1 | io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
app-1 | java.base/java.lang.Thread.run(Unknown Source)

Additional notes

• The issue reproduces only for multipart. A raw (non‑multipart) upload endpoint does not leak under the same abort conditions.
• The leak appears even if application logic is effectively a no‑op (no downstream calls, no further processing).

Questions

• Is this a known issue in multipart parsing under client abort?
• Is there a recommended way to ensure inbound buffers are released in this scenario?

[bclozel]

@dmittriy13 Thanks for reaching out. Can you reproduce the same problem with Spring Boot 3.5.6? Maybe this is related to #35623 and this introduced a regression. Thanks.

[dmittriy13]

@dmittriy13 Thanks for reaching out. Can you reproduce the same problem with Spring Boot 3.5.6? Maybe this is related to #35623 and this introduced a regression. Thanks.

Confirmed — I was able to reproduce the issue on Spring Boot 3.5.6.
I’ve created a separate 3.5.6 branch in the project that reproduces the problem.

[bclozel]

Thanks for the sample @dmittriy13 , but unfortunately this is going to be challenging to find the root of the problem.

I have reviewed MultipartParser and PartGenerator implementations (especially the management of the "dispose" transitions and states). We do have tests for cancellations in DefaultPartHttpMessageReaderTests and they look pretty accurate to me.

I have tried to get more logs about the state of the parser when this happens, but of course the added processing time makes the problem go away for me.

logging:
  file:
    path: /tmp
  level:
    org:
      springframework:
        web:
          server:
            adapter: FATAL
        http:
          codec:
           multipart: TRACE

I guess that the problem is probably in MultipartParser or PartGenerator around the file state management, because raising the max-in-memory-size also makes the problem go away. I'll dig into this a bit more next week.