---
title: "Tomcat 11: Lenient vs Strict Defaults, Side by Side"
description: "A side-by-side comparison of legacy Tomcat defaults and the strict defaults in Tomcat 11, showing which behaviors change and what to verify before you upgrade a Java web tier."
---

# Tomcat 11: Lenient vs Strict Defaults, Side by Side

**Type:** [Comparison](https://yomu.fyi/visual-explainers/category/comparison.md)

![Two-column comparison of legacy Tomcat defaults on the left and Tomcat 11 / JBoss Web Server 7 strict defaults on the right, with paired rows for Java baseline, parameter parsing, filtering and HTTP/2 push, cookie quotes, security boundary, and base image, ending in a short upgrade checklist.](https://yomufyi.s3.us-east-1.amazonaws.com/visual-explainers/9819d61d-d91e-44fb-a231-27a771700043/image-0b33323e-3faf-4e81-8b0c-5d0a590fb282.webp)

> A side-by-side comparison of legacy Tomcat defaults and the strict defaults in Tomcat 11, showing which behaviors change and what to verify before you upgrade a Java web tier.

## Explanation

Apache Tomcat 11, shipped inside Red Hat JBoss Web Server 7, keeps the servlet container model but tightens many runtime defaults. Java 17 is the new minimum, malformed request parameters throw instead of being ignored, maxParameterCount drops to 1,000, and FailedRequestFilter and HTTP/2 push are removed, with cookie quotes retained per RFC 6265. The Java SecurityManager is gone, container isolation replaces it, and UBI 8 images and bundled Prometheus are dropped. Treating the upgrade as a version bump pushes these changes into production, so each changed default is framed as a decision to adopt or compensate for before rollout.

## FAQ

### What actually changes in Tomcat 11 parameter handling?

Malformed request parameters now throw exceptions instead of being tolerated, and maxParameterCount falls from 10,000 to 1,000. FailedRequestFilter and HTTP/2 push are removed, so malformed-input handling moves into application code or a front proxy. Test forms, uploads, and clients that send junk payloads before you upgrade.

### Can I still use the Java SecurityManager after upgrading to Tomcat 11?

No. The SecurityManager is removed in this generation, so policies that depended on it no longer run. Red Hat recommends container isolation as the replacement, which also means rebuilding onto UBI 9 base images because UBI 8 images are discontinued. Audit your own code and dependencies for SecurityManager usage first.

### Why is rejecting malformed input better than ignoring it?

Strict defaults trade silent acceptance for deterministic rejection, so a bad request fails visibly instead of reaching application logic in a half-parsed state. A similar managed-Postgres design caps memory so an oversized query fails cleanly rather than crashing the host. The cost is that previously working traffic may now be rejected, so validate with realistic requests first.

**Tags:** [Apache Tomcat](https://yomu.fyi/topic/apache-tomcat.md), [Containers](https://yomu.fyi/topic/containers.md), [Deployment](https://yomu.fyi/topic/deployment.md), [Jakarta EE](https://yomu.fyi/topic/jakarta-ee.md), [Java](https://yomu.fyi/topic/java.md), [Migrations](https://yomu.fyi/topic/migration.md)

## Related reading

### [Why model versioning is not enough for production AI](https://yomu.fyi/post/why-model-versioning-is-not-enough-for-production-ai.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Silu Panda
- Published: Sep 28, 2026
- Type: Problem & solution

Model versioning alone is insufficient for production AI because changes in inputs, preprocessing, prompts, retrieval, tool contracts, and serving settings can alter behavior independently. The post proposes a versioned release manifest that captures all interdependent components, including model revision, prompt revision, retrieval index revision, embedding revision, pipeline revision, and runtime revision covering token limits, batching, and timeouts. This manifest enables atomic release testing and rollback, with an evaluation gate that tests the full retrieval-generation path using deterministic checks and semantic rubrics on a versioned dataset. Practical steps include canary deployments that compare candidate and control signals, with explicit stop conditions and rollback procedures that restore compatible dependencies rather than just older model weights. The post concludes that the smallest useful implementation is a manifest, evaluation job, load test, release-aware traces, and a rehearsed rollback, and asks whether the on-call engineer can identify and restore a compatible known-good version.


### [Can your Postgres survive a bad query?](https://yomu.fyi/post/can-your-postgres-survive-a-bad-query.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Sep 28, 2026
- Type: Benchmark

Postgres memory tuning is difficult because work\_mem applies per operation, not per query, and parallel workers multiply memory usage without a query-wide cap. Some executor structures, such as those in recursive queries, have no disk-backed fallback and can grow until the backend runs out of memory. A benchmark using a recursive query that exhausts memory tested ClickHouse Managed Postgres, Cloud SQL, PlanetScale, and Amazon RDS on 16 GiB instances. ClickHouse Managed Postgres enforces a memory ceiling at 57% of host RAM, rejecting queries that exceed it, while RDS allows backends to consume nearly all RAM until the host crashes. Cloud SQL and PlanetScale enforce similar caps, but ClickHouse Managed Postgres’s ceiling is lower, a deliberate tradeoff that returns clean query failures instead of forcing every client through crash recovery.


### [Upgrading to Red Hat JBoss Web Server 7: Key changes & impacts](https://yomu.fyi/post/upgrading-to-red-hat-jboss-web-server-7-key-changes-impacts.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Jeff Beck
- Published: Sep 28, 2026
- Type: Explainer

Red Hat JBoss Web Server 7, based on Apache Tomcat 11 and Jakarta EE 11, requires Java 17 as the new minimum and drops support for Java 11. Jakarta EE 11 does not require another import rename but adds a RecordELResolver for records and an OptionalELResolver for optionals. Tomcat 11 changes parameter parsing to throw exceptions on malformed requests, reduces maxParameterCount to 1,000 from 10,000, removes FailedRequestFilter and HTTP/2 push, and retains quotes in cookie values per RFC 6265. The Java SecurityManager is removed, UBI 8 images are discontinued for UBI 9, Prometheus is no longer bundled, and Red Hat recommends container isolation as replacement. Teams must confirm Java 17 readiness, check for SecurityManager usage, update their base image pipeline, and note that Spring Boot 4 on JWS 7 is unsupported.


### [A More Reliable Compilation Scheme for Kotlin Multiplatform Modules](https://yomu.fyi/post/a-more-reliable-compilation-scheme-for-kotlin-multiplatform-modules.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Aleksey Zamulla
- Published: Sep 28, 2026
- Type: Announcement

Kotlin Multiplatform’s current compilation scheme can cause IDE and compiler disagreements or unexpected resolution of platform-specific declarations from common source sets. In Kotlin 2.5.0-Beta1, an optional separate compilation approach aligns compiler behavior with IDE analysis, making common code resolve only against metadata KLIB declarations. This also eliminates issues like overload selection differing by target and type inference failures in platform code. Separate compilation is experimental and disabled by default, enabled by adding kotlin.kmp.separateCompilation=true to gradle.properties. Known issues include problems with cinterop commonization and single-target modules; library authors must publish metadata KLIBs for the feature to work correctly.