AIKIDO-2026-109779

TL;DR

StompSubframeDecoder allocates a buffer once the content-length is satisfied but parks it while awaiting the terminating NUL byte, and overrides neither handlerRemoved0 nor channelInactive. A remote peer that sends a well-formed frame body without its trailing NUL leaks one buffer per connection, and with pooled allocators that memory never returns to the pool. Sustained connections accumulate leaked buffers for the process lifetime, exhausting memory. The fix releases the parked buffer on handler removal.