To address CVE-2025-48976 and CVE-2025-48988, Tomcat 10.1.42 has
introduced two new configuration settings – maxPartCount and
maxPartHeaderSize. The default values for these configuration
settings have proven hard to get right and some applications have
had to increase the default limits. To ease their configuration in
Spring Boot, this commit introduces configuration properties for
the new settings:
- server.tomcat.max-part-count (maxPartCount)
- server.tomcat.max-part-header-size (maxPartHeaderSize)
The defaults are aligned with those of Tomcat 10.1.42
(10 and 512 bytes respectively).
Closes gh-45869
Restore knownIndexedChildren logic in IndexedElementsBinder to that of
Spring Boot 3.4, effectively reverting commit 93113a415f.
The performance improvements unfortunately caused the unwanted
side-effect of no longer checking the all indexed elements were fully
bound. Performance was also actually reduced for non iterable property
sources that used deeply nested structures.
In order to keep some performance improvements, the updated code
also makes the following changes:
* A `Set` is used rather than `LinkedMultiValueMap` for tracking. The
full list of unbound properties are now only calculated when the
exception is thrown.
* If possible, the source is filtered early and passed down for child
element binding. This should help reduce repeated full scans of
all configuration property names.
* The `FilteredIterableConfigurationPropertiesSource` has been optimized
for immutable `SpringIterableConfigurationPropertySource` use.
Fixes gh-45994
See gh-45970
See gh-44867
Update `ManagementContextAutoConfiguration` to use an immutable
`EnumerablePropertySource` to provide better property binding
performance.
See gh-45968
Signed-off-by: tanruian <tanruiantra@qq.com>
Andy Wilkinson
David LJ
Stéphane Nicoll
Moritz Halbritter
Johnny Lim
Phillip Webb
tanruian