There are two issues with the way ClusteredSession and subclasses are handling the invocation of HttpSessionBindingListener.valueUnbound() when an attribute is put into a session.

1) AttributeBasedClusteredSession.setJBossInternalAttribute() is returning the wrong object – rather than returning any object already bound to the given key, it's returning the new value. This results in valueUnbound() being called on the wrong object.

2) In ClusteredSession, there is no test for object equality between the object passed as the value to setAttribute and any already existing object bound to that key. This should be tested before valueUnbound() is invoked, since if the object is identical it hasn't actually been unbound.