From 2e653246b5f27dc0baa6aa09ae207512bed45899 Mon Sep 17 00:00:00 2001 From: Juergen Hoeller Date: Wed, 3 Jun 2026 23:03:39 +0200 Subject: [PATCH] Fix concurrency issue against shared cookie field in setLocaleContext Closes gh-36869 --- .../web/servlet/i18n/CookieLocaleResolver.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/i18n/CookieLocaleResolver.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/i18n/CookieLocaleResolver.java index 8e11fc8e6bb..61993f0cc44 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/i18n/CookieLocaleResolver.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/i18n/CookieLocaleResolver.java @@ -340,15 +340,16 @@ public class CookieLocaleResolver extends AbstractLocaleContextResolver { Locale locale = null; TimeZone zone = null; + ResponseCookie cookie = this.cookie; if (localeContext != null) { locale = localeContext.getLocale(); if (localeContext instanceof TimeZoneAwareLocaleContext timeZoneAwareLocaleContext) { zone = timeZoneAwareLocaleContext.getTimeZone(); } String value = (locale != null ? toLocaleValue(locale) : "-") + (zone != null ? '/' + zone.getID() : ""); - this.cookie = this.cookie.mutate().value(value).build(); + cookie = this.cookie.mutate().value(value).build(); } - response.addHeader(HttpHeaders.SET_COOKIE, this.cookie.toString()); + response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString()); request.setAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME, (locale != null ? locale : this.defaultLocaleFunction.apply(request))); request.setAttribute(TIME_ZONE_REQUEST_ATTRIBUTE_NAME,