This is related to Tomcat issue 49230: https://issues.apache.org/bugzilla/show_bug.cgi?id=49230

When a servlet creates a URLConnection, internally this is done us-ing
sun.net.www.http.HttpClient. To have the ability to keep connections alive and
close them after a certain time they are placed inside a cache. A static
reference is kept to this cache (sun.net.www.http.KeepAliveCache).

This cache contains a non-final reference to a Thread which keeps a reference to the Application's ClassLoader, hence a Class Loader leak.

The Tomcat patch won't work because the reference to the Thread is non-final and so a new thread maybe created during the application's lifecycle, far after the startup.

I don't have any solution to this issue, I'm afraid. The only workaround I've found is to run this code during the shutdown of my application. This is very ugly though:

   final KeepAliveCache keepAliveCache = new HttpClient() {
       public KeepAliveCache getKeepAliveCache() {
         return kac;
       }
   }.getKeepAliveCache();
   
   final Field f = KeepAliveCache.class.getDeclaredField("keepAliveTimer");
   f.setAccessible(true);
   f.set(keepAliveCache, null);