AIKIDO-2026-279795

TL;DR

The ChunkedDecoder used for Transfer-Encoding: chunked bodies fails to advance its buffer when a terminating chunk arrives without a trailing CRLF, so the decode loop re-enters with identical state and spins forever; a completed chunk followed by exactly two non-CRLF bytes hits the same off-by-one and loops instead of erroring. A malformed chunked message freezes the event loop and consumes CPU, taking the whole process offline. This reaches both the HTTP server (request bodies) and the HTTP client (response bodies). The fix returns early to wait for more trailer data, caps a pending trailer at MAX_CHUNK_HEADER_SIZE, and reports an invalid chunk terminator instead of looping.