Increase in number of active HTTP connections when upgrading to Spring Boot 3.5.4

[ingmars1709]

Since upgrading from Spring Boot 3.5.3 to Spring Boot 3.5.4 we see an increase in the number of active http-connections.
(using the metric: spring_security_http_unsecured_requests_active_seconds_sum)

This finally results in unresponsiveness of our Spring Boot application that routes incoming calls to other Spring Boot applications using spring-cloud-starter-gateway-mvc (4.3.0)

Our load-profile is the same on the application and we see incoming calls suddenly taking more than 10+ minutes to complete.

It looks like incoming connections are not closed in some way.

No other clear leads in logging or metrics what could be the case.

The changelogs of the embedded Catalina Tomcat versions 10.1.42 and 10.1.43 in Spring Boot don't give a clear lead either:

https://tomcat.apache.org/tomcat-10.1-doc/changelog.html

[bclozel]

Thanks for this report, but unfortunately this isn't really actionable on our side. This seems to involve Spring Boot, Spring Cloud Gateway, Tomcat and possibly other libraries.

I would suggest working on a minimal sample, removing as much as possible from the picture - or using Spring Boot 3.5.4 but locally downgrading the Tomcat version (or other libraries) to check whether the problem still happens.