Rule of thumb: If you have custom ThreadLocal classes or custom classes as values in your ThreadLocal in a web (or other multi classloader) environment, you should have a try / finally blocks to clear the ThreadLocal once you're finished.
I have blogged about the subject here: http://java.jiderhamn.se/2012/01/29/classloader-leaks-iv-threadlocal-dangers-and-why-threadglobal-may-have-been-a-more-appropriate-name/

At a quick glance it seems this patch contains both custom ThreadLocals and custom values. I admit I'm just guessing, but they probably aren't cleared either...?

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators.
For more information on JIRA, see: http://www.atlassian.com/software/jira