Hello Thomas Wöckinger

Do you think you could provide us with a reproducer?

Also please clarify the structure of the deployment (WAR with a lib, standalone jar, ...). Have you tried this somewhere else than on Tomcat (SE, another server/servlet)?
Do you run the app with security manager?