The BridgeRequestScopeManagerImpl.getBridgeRequestScope(PortletConfig, PortletContext, PortletRequest, PortletResponse) method has a memory leak. However, this is only a problem when developers specify com.liferay.faces.bridge.bridgeRequestScopePreserved=true in the WEB-INF/portlet.xml descriptor (for more info, see
FACES-219). The default value is false and so this probably isn't a serious issue for most portlets.
The leak happens when the method is called during the RENDER_PHASE of portlet lifecycle. Specifically, after the BridgeRequestScope is instantiated, it is placed into the cache/map. But it should only be stored in the cache during the ACTION_PHASE, EVENT_PHASE, or RESOURCE_PHASE. No sense in storing it in the cache for a RENDER_PHASE since the lifespan of a BridgeRequestScope starts with an full postback action (most commonly), and with Ajax request (less commonly).