DefaultServlet uses File.deleteOnExit() which is known to leak jvm native memory.
The call is made on executePartialPut() (called from doPut()).

Any server running for a long time will not get rid of these orphan requests to
delete tmp PUT files on exit and may run out of memory if PUTting many files.

The solution is to completely avoid such method. You must deal manually with the
deletion of unused files. You can use try{create+use}finally{delete}.

If it is done in many phases (I'm not sure what partial PUT means) you must
associate that file to the httpsession so that the httpsession disposal will
delete the tmp file safely. If there is no session ongoing you must deny
multiphase PUT to stay safe.

In any case, partial PUT or not, a jvm crash may leave those tmp files
undeleted, so it would be safer to assign a directory to tomcat tmpfiles
(already exists I think) and wipe it clean on tomcat start. If you don't want to
delete all files, then choose filenames that have a pattern unlikely to clash
with existing files. Better, choose filenames that you can assert they came from
tomcat.

example: _tmp_tomcat_[userfilename]_[privatehashOf(userfilename)].tmp
when you read the "userfilename", only tomcat can rehash and compare with the
private hash number. If the hash number is not equal, it is not a tomcat tmp
file. This makes it really hard for a user to accidentally loose a file in that
tmp folder.