The inner class org.apache.tomcat.dbcp.dbcp2.BasicDataSource$PaGetConnection was removed in 9.0.38, but the class is still loaded in the static initialization block when the SecurityManager is activated. The problematic code also exists upstream in the Apache Commons DBCP project. I haven't reported it there yet. Stacktrace: Caused by: java.lang.IllegalStateException: Unable to pre-load classes at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.<clinit>(BasicDataSource.java:94) ~[tomcat-dbcp.jar:9.0.38] ... 123 more Caused by: java.lang.ClassNotFoundException: org.apache.tomcat.dbcp.dbcp2.BasicDataSource$PaGetConnection at java.net.URLClassLoader.findClass(URLClassLoader.java:471) ~[?:?] at java.lang.ClassLoader.loadClass(ClassLoader.java:589) ~[?:?] at java.lang.ClassLoader.loadClass(ClassLoader.java:522) ~[?:?] at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.<clinit>(BasicDataSource.java:79) ~[tomcat-dbcp.jar:9.0.38] ... 123 more
Thanks for the report and the analysis. Fixed in: - master for 10.0.0-M9 onwards - 9.0.x for 9.0.39 onwards - 8.5.x for 8.5.59 onwards