Why Spring Boot 4.0 Dropped Undertow Support and What It Means for Your Projects

Spring Boot 4.0 Removes Undertow Support

Spring Boot 4.0 RC1 was released and one major change is the complete removal of support for the Undertow web container. Projects that depend on

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
</dependency>

will fail to build because the auto‑configuration and dependency management for Undertow have been dropped.

"Spring Boot 4.0 requires a Servlet 6.1 baseline, and Undertow is not yet compatible. Therefore we have dropped support for Undertow."

The underlying issue is a version mismatch: Servlet 6.1 is required, and Undertow has not caught up, making this a compatibility problem rather than a performance decision.

Undertow’s maintainers at Red Hat have indicated that work on Servlet 6.1 support is still in early stages, leaving enterprises with limited migration options.

Servlet 6.1 Technical Highlights

ByteBuffer Support

Both ServletInputStream and ServletOutputStream now support ByteBuffer , improving non‑blocking I/O performance.

// Using ByteBuffer to read request data
ByteBuffer buffer = ByteBuffer.allocate(1024);
servletInputStream.read(buffer);

HTTP/2 Server Push Deprecated

Servlet 6.1 officially deprecates HTTP/2 Server Push, reflecting its declining usage in modern web applications.

SecurityManager API Removal

The deprecated Java SecurityManager APIs have been completely removed to align with the evolving Java SE security model.

HTTP Session Enhancements

New mechanisms allow interaction with HTTP sessions beyond standard request handling, improving support for WebSocket scenarios.

Redirect Control Improvements

Developers now have finer control over status codes and response bodies when issuing HTTP redirects.

// Custom redirect response
response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY);
response.setHeader("Location", newUrl);
response.getWriter().write("Resource has moved");

Sensitive Header Handling

A new method HttpServlet.isSensitiveHeader identifies headers such as Authorization, Cookie, and Forwarded that should be omitted from TRACE responses, enhancing security.

Conditional GET Optimization

Support for conditional GET operations has been improved via the getLastModified method, reducing unnecessary data transfer.

Jakarta EE 11 and Jakarta Data

Jakarta EE 11 is the latest enterprise Java platform, with Servlet 6.1 as a core sub‑specification. Jakarta Data introduces a standardized abstraction for data access, reducing boilerplate code.

Core Jakarta Data Features

BasicRepository

public interface ProductRepository extends BasicRepository<Product, Long> {
    // Provides save(), findById(), findAll(), delete()
}

CrudRepository

public interface UserRepository extends CrudRepository<User, String> {
    List<User> findByEmailContaining(String email);
    Page<User> findByStatus(UserStatus status, PageRequest page);
}

Pagination

// Offset‑based pagination
Page<Product> findByCategory(String category, PageRequest pageRequest);

// Cursor‑based pagination
CursoredPage<Product> findByPriceGreaterThan(BigDecimal price, PageRequest pageRequest);

Query Language

@Query("SELECT o FROM Order o WHERE o.status = ?1 AND o.total > ?2")
List<Order> findHighValueOrders(OrderStatus status, BigDecimal minTotal);

Web Container Compatibility Matrix

The following summary shows support for Servlet 6.1 and Jakarta EE 11 across major containers:

Spring Framework 7.x – Full support for both.

Spring Boot 4.x – Full support for both.

Tomcat 11.x+ – Full support for both.

Jetty 12.1+ – Full support for both.

Undertow 2.3.x – No support for either.

The matrix makes clear that Undertow is the only mainstream container lacking Servlet 6.1 support, which explains Spring Boot 4.0’s decision to drop Undertow.