AIKIDO-2026-739270

TL;DR

Netty's HTTP/2 content decompression via DelegatingDecompressorFrameListener leaks direct ByteBuf memory when a remote peer sends DATA frames for a stream whose decompressor channel has already been closed. In Http2Decompressor.decompress(...), data.retain() increments the buffer reference count before writeInbound(...), but when the internal decompressor EmbeddedChannel is already closed, ensureOpen() throws and the extra reference is never released on the error path. A remote, unauthenticated attacker can repeat this over a long-lived HTTP/2 connection to exhaust direct memory and crash the JVM with OutOfMemoryError.