InMemorySessionManager Session Creation Not Thread Safe

package reproducer; import io.undertow.Undertow; import io.undertow.server.HttpHandler; import io.undertow.server.HttpServerExchange; import io.undertow.server.session.InMemorySessionManager; import io.undertow.server.session.Session; import io.undertow.server.session.SessionAttachmentHandler; import io.undertow.server.session.SessionConfig; import io.undertow.server.session.SessionCookieConfig; import io.undertow.server.session.SessionManager; import io.undertow.util.Headers; public class Reproducer { public static void main(final String[] args) { SessionManager sessionManager = new InMemorySessionManager( "SESSION_MANAGER"); SessionCookieConfig sessionConfig = new SessionCookieConfig(); /* Use the sessionAttachmentHandler to add the sessionManager and sessionCofing to the exchange of every request */ SessionAttachmentHandler sessionAttachmentHandler = new SessionAttachmentHandler( sessionManager, sessionConfig); // set as next handler your root handler sessionAttachmentHandler.setNext(new HttpHandler() Unknown macro: { @Override public void handleRequest(final HttpServerExchange exchange) throws Exception Unknown macro: { SessionManager sm = exchange .getAttachment(SessionManager.ATTACHMENT_KEY); SessionConfig sessionConfig = exchange .getAttachment(SessionConfig.ATTACHMENT_KEY); Session session = sm.getSession(exchange, sessionConfig); if (session == null) session = sm.createSession(exchange, sessionConfig); exchange.getResponseHeaders().put(Headers.CONTENT_TYPE, "text/plain"); exchange.getResponseSender().send("Hello World"); } } ); Undertow server = Undertow.builder() .addHttpListener(8080, "localhost") .setHandler(sessionAttachmentHandler).build(); server.start(); } } Create urls.txt with as many lines you like: cat urls.txt url = "http://localhost:8080" url = "http://localhost:8080" url = "http://localhost:8080" url = "http://localhost:8080" url = "http://localhost:8080" url = "http://localhost:8080" url = "http://localhost:8080" 3. INvoke( change ID on every call) curl -X GET -b 'JSESSIONID=xxxxxx3' --verbose --parallel --parallel-immediate --parallel-max 5 --config urls.txt possibly bump up max. Though its hard to reproduce. possibly: #!/bin/bash set -x for i in {0..200..1} do salt="$RANDOM" curl -b \'JSESSIONID=xx"$salt"xx\' --verbose --parallel --parallel-immediate --parallel-max 15 --config urls.txt done