tomcat-dbcp.jar embeds commons-pool-2.5.0 classes (org.apache.tomcat.dbcp.pool2.*) (maybe through commons-dbcp-2.2.0 classes) There is a memory leak, fixed in commons-pool: https://issues.apache.org/jira/browse/POOL-337 but not yet released. This bug is tracked in commons-dbcp, unfixed for now: https://issues.apache.org/jira/browse/DBCP-493 This leak needs merging toward tomcat distribution when released.
Fixed in trunk for 9.0.9 onwards. Back-ports to follow.
Fixed in: - 8.5.x for 8.5.32 onwards - 8.0.x for 8.0.53 onwards