ThreadLocal in a pooled executor is a leak and a data leak

A pooled thread outlives the request that set the value. The next task on that thread inherits it - so the entry never becomes garbage, and one user's tenant or principal is read by another user's request.

• Utilities: a private constructor with only static members documents a utility class
• Utilities: new Random(seed) produces the same sequence every run
• Utilities: UUID.nameUUIDFromBytes produces the same UUID for the same input
• Utilities: Base64 encodes bytes into ASCII text and decodes them back
• Utilities: HexFormat converts bytes to and from a hex string
• Utilities: Arrays.deepEquals compares nested arrays, equals does not

---

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25

© Java Coding Hub · About · Contact · Privacy · Terms