Spring Boot 3.2.2适配Tomcat 11.0.0-M+启动失败问题求助

为修复tomcat-embed-core的漏洞，将其版本升级到11.0.0-M6及以上后，应用启动失败。原因是该版本中AbstractHttp11Protocol类的setRejectIllegalHeader方法已被移除，但Spring Boot的TomcatWebServerFactoryCustomizer类仍在调用此方法。

启动错误日志如下：

***************************
APPLICATION FAILED TO START
***************************

Description:

An attempt was made to call a method that does not exist. The attempt was made from the following location:

    org.springframework.boot.autoconfigure.web.embedded.TomcatWebServerFactoryCustomizer.lambda$customizeRejectIllegalHeader$20(TomcatWebServerFactoryCustomizer.java:209)

The following method did not exist:

    'void org.apache.coyote.http11.AbstractHttp11Protocol.setRejectIllegalHeader(boolean)'

The calling method's class, org.springframework.boot.autoconfigure.web.embedded.TomcatWebServerFactoryCustomizer, was loaded from the following location:

    jar:file:/Users/XXXXX/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/3.2.3/59db74eb4196885bb5a149417ab1ab51dc9b6952/spring-boot-autoconfigure-3.2.3.jar!/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.class

The called method's class, org.apache.coyote.http11.AbstractHttp11Protocol, is available from the following locations:

    jar:file:/Users/XXXXX/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/11.0.0-M17/d3818654cd6bf4241e9ade24531727a214a5b18f/tomcat-embed-core-11.0.0-M17.jar!/org/apache/coyote/http11/AbstractHttp11Protocol.class
    jar:file:/Users/XXXXX/.gradle/caches/modules-2/files-2.1/org.apache.tomcat/tomcat-coyote/11.0.0-M17/9101e5a5f564483d13b5cb0bfeb1f042c22a014b/tomcat-coyote-11.0.0-M17.jar!/org/apache/coyote/http11/AbstractHttp11Protocol.class

The called method's class hierarchy was loaded from the following locations:

    org.apache.coyote.http11.AbstractHttp11Protocol: file:/Users/XXXXX/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/11.0.0-M17/d3818654cd6bf4241e9ade24531727a214a5b18f/tomcat-embed-core-11.0.0-M17.jar
    org.apache.coyote.AbstractProtocol: file:/Users/XXXXX/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/11.0.0-M17/d3818654cd6bf4241e9ade24531727a214a5b18f/tomcat-embed-core-11.0.0-M17.jar


Action:

Correct the classpath of your application so that it contains compatible versions of the classes org.springframework.boot.autoconfigure.web.embedded.TomcatWebServerFactoryCustomizer and org.apache.coyote.http11.AbstractHttp11Protocol

当前使用的build.gradle.kts配置：

plugins {
    id("org.springframework.boot") version "3.2.2"
    id("io.spring.dependency-management") version "1.1.4"
    kotlin("jvm") version "1.9.22"
    kotlin("plugin.spring") version "1.9.22"
    kotlin("plugin.jpa") version "1.9.22"
}

group = "com.company"

java {
    sourceCompatibility = JavaVersion.VERSION_21
}

repositories {
    mavenCentral()
}

dependencies {
    implementation("org.springframework.boot:spring-boot-starter-actuator")
    implementation("org.springframework.boot:spring-boot-starter-data-jpa")
    implementation("org.springframework.boot:spring-boot-starter-web")
    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.boot:spring-boot-starter-data-redis") { exclude(group = "io.lettuce", module = "lettuce-core") }
    implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
    implementation("org.jetbrains.kotlin:kotlin-reflect")
    implementation("com.amazon.ion:ion-java:1.11.0")
    implementation("com.amazonaws:aws-java-sdk-sts:1.12.636") { exclude(group = "software.amazon.ion", module = "ion-java") }
    implementation("com.amazonaws:aws-java-sdk-secretsmanager:1.12.636") { exclude(group = "software.amazon.ion", module = "ion-java") }
    implementation("org.apache.tomcat.embed:tomcat-embed-core:11.0.0-M16")
    runtimeOnly("org.postgresql:postgresql:42.7.2")
    testImplementation("org.springframework.boot:spring-boot-starter-test")
}

tasks.withType<KotlinCompile> {
    kotlinOptions {
        freeCompilerArgs += "-Xjsr305=strict"
        jvmTarget = "21"
    }
}

tasks.withType<Test> {
    useJUnitPlatform()
}

环境信息：Spring Boot 3.2.2、Java 21

1. 升级Spring Boot版本到兼容Tomcat 11的版本 #

Spring Boot 3.2.x系列未适配Tomcat 11的API变更，需升级到3.3.x及以上稳定版本，该版本已移除对setRejectIllegalHeader方法的调用，适配了Tomcat 11的改动。

修改build.gradle.kts中的Spring Boot插件版本，同时更新dependency-management插件版本以匹配：

plugins {
    id("org.springframework.boot") version "3.3.0" // 或最新稳定版
    id("io.spring.dependency-management") version "1.1.5" // 对应匹配版本
    // 其他插件版本保持不变
}

2. 移除手动指定的Tomcat依赖 #

Spring Boot的spring-boot-starter-web会自动管理Tomcat相关依赖的版本，手动指定tomcat-embed-core会导致版本冲突。删除dependencies中的以下行：

implementation("org.apache.tomcat.embed:tomcat-embed-core:11.0.0-M16")

3. 验证依赖一致性 #

执行以下命令检查Tomcat相关依赖的版本是否统一，确保没有混合不同版本的组件：

./gradlew dependencies

修改后的完整build.gradle.kts示例 #

plugins {
    id("org.springframework.boot") version "3.3.0"
    id("io.spring.dependency-management") version "1.1.5"
    kotlin("jvm") version "1.9.22"
    kotlin("plugin.spring") version "1.9.22"
    kotlin("plugin.jpa") version "1.9.22"
}

group = "com.company"

java {
    sourceCompatibility = JavaVersion.VERSION_21
}

repositories {
    mavenCentral()
}

dependencies {
    implementation("org.springframework.boot:spring-boot-starter-actuator")
    implementation("org.springframework.boot:spring-boot-starter-data-jpa")
    implementation("org.springframework.boot:spring-boot-starter-web")
    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.boot:spring-boot-starter-data-redis") { exclude(group = "io.lettuce", module = "lettuce-core") }
    implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
    implementation("org.jetbrains.kotlin:kotlin-reflect")
    implementation("com.amazon.ion:ion-java:1.11.0")
    implementation("com.amazonaws:aws-java-sdk-sts:1.12.636") { exclude(group = "software.amazon.ion", module = "ion-java") }
    implementation("com.amazonaws:aws-java-sdk-secretsmanager:1.12.636") { exclude(group = "software.amazon.ion", module = "ion-java") }
    runtimeOnly("org.postgresql:postgresql:42.7.2")
    testImplementation("org.springframework.boot:spring-boot-starter-test")
}

tasks.withType<KotlinCompile> {
    kotlinOptions {
        freeCompilerArgs += "-Xjsr305=strict"
        jvmTarget = "21"
    }
}

tasks.withType<Test> {
    useJUnitPlatform()
}

内容的提问来源于stack exchange，提问作者naa-at