Security: HTTPStreamLoader never calls HttpURLConnection.disconnect() — connection leak (CWE-772)

[coggiyadmin]

Summary

HTTPStreamLoader opens an HttpURLConnection to load configuration but never calls disconnect(), leaking the underlying TCP connection and associated resources.

Location

archaius2-persisted2/src/main/java/com/netflix/archaius/persisted2/loader/HTTPStreamLoader.java — line 20

public InputStream call() throws Exception {
    URL url = new URL(configUrl);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    // ... sets headers, reads stream ...
    return connection.getInputStream();
    // disconnect() is never called — connection leaks
}

Risk

• CWE-772: Missing Release of Resource after Effective Lifetime
• Each poll cycle opens a new TCP connection that is never explicitly closed
• Under frequent polling this can exhaust OS socket/file descriptor limits, especially in high-reload-rate environments
• May cause connection pool exhaustion on the server side as well

Suggested fix

Use try-with-resources or a finally block to ensure disconnect() is called after the stream is fully consumed:

HttpURLConnection connection = (HttpURLConnection) url.openConnection();
try {
    // ... configure and read ...
    return IOUtils.toByteArray(connection.getInputStream()); // buffer first
} finally {
    connection.disconnect();
}

Note: if the caller expects a live InputStream, buffer the response bytes before disconnecting.

Discovered by

Automated security scan (cognium-ai) of the OSS-Fuzz Java corpus, June 2026.