There is a ByteBuf that is created but never released in ResteasyHttpRequestDecoder. Netty reports this with the following log line:

LEAK: ByteBuf.release() was not called before it's garbage-collected

There is a retain called on the HttpRequest content before the newly created Bytebuf is added to an input stream. I'm not entirely sure why this retain is required so I have attached two different pull requests to this issue. One that drops the retain and one that releases the Bytebuf. I would appreciate any information on why the retain is necessary.