AIKIDO-2026-816961

TL;DR

connectrpc's server reads a client-streaming or bidirectional-streaming request body in a background task that keeps running after the handler returns, an interceptor rejects the call, or the request timeout fires. Before the fix, that task has no time limit, so a client that stops sending mid-message keeps the task, its buffered partial message, and the HTTP/2 stream or HTTP/1.x connection open indefinitely. A caller can hold many such calls open at once to exhaust server memory, tasks, and file descriptors. The fix applies an absolute five second timeout to the drain so a stalled client loses the stream or connection instead of holding it forever.