PH13269: DELAY ALPN INIT UNTIL REQUIRED AND FREE ALPN RESOURCES ON CONNECTION ERRORS TO PREVENT OUTOFMEMORY

19.0.0.6: WebSphere Application Server Liberty 19.0.0.6
19.0.0.7: WebSphere Application Server Liberty 19.0.0.7
19.0.0.8: WebSphere Application Server Liberty 19.0.0.8
19.0.0.9: WebSphere Application Server Liberty 19.0.0.9
19.0.0.10: WebSphere Application Server Liberty 19.0.0.10
19.0.0.11: WebSphere Application Server Liberty 19.0.0.11
19.0.0.12: WebSphere Application Server Liberty 19.0.0.12
20.0.0.1: WebSphere Application Server Liberty 20.0.0.1
20.0.0.2: WebSphere Application Server Liberty 20.0.0.2
20.0.0.3: WebSphere Application Server Liberty 20.0.0.3
20.0.0.4: WebSphere Application Server Liberty 20.0.0.4
20.0.0.5: WebSphere Application Server Liberty 20.0.0.5

APAR status

• Closed as program error.

Error description

• Whenever the client connections fail the connection with
  "bad
  certificate", the server isn't cleaning up and this
  eventually
  results in an OutOfMemory error.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: OutOfMemory condition can occur when    *
  *                      HTTP/2 is enabled.                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When HTTP/2 is enabled, failed HTTP connection attempts over SSL
  can leak a very small amount of memory.  Over time, this can
  accumulate and lead to an OutOfMemory condition.  This problem
  occurs because the HTTP/2 code is not properly cleaning up the
  connection objects on these failed connection attempts.
  
  The leak suspect will likely show up as a
  java.util.concurrent.ConcurrentHashMap$Node[] being held by a
  com.ibm.jsse2.ext.a object.
  

Problem conclusion

• Objects are now properly cleaned up on failed HTTP connection
  attempts over SSL when HTTP/2 is enabled.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 19.0.0.6  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

• Disabling HTTP/2 via configuration parameters in the server.xml
  will prevent this problem.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS LIBERTY COR

• Fixed component ID

  5725L2900

Applicable component levels

• RCD0 PSY

     UP