Hi,

We updated from Spring Boot 4.0.2 to 4.0.3 and noted that suddenly response headers were missing. We used a simple demo projected created with the Spring Initializr to test this. A simple security chain adds some headers.

@Bean
SecurityFilterChain securityFilterChain( final HttpSecurity httpSecurity ) {
	return httpSecurity
			.securityMatcher( "/**" )
			.headers( c -> c.contentSecurityPolicy( withDefaults( ) ) )
			.authorizeHttpRequests( a -> a
					.anyRequest( )
					.anonymous( ) )
			.build( );
}

With 4.0.2 we would get the following headers:

HTTP/1.1 200
Last-Modified: Tue, 24 Feb 2026 10:55:17 GMT
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'
Content-Type: text/html
Content-Language: de-DE
Content-Length: 23
Date: Tue, 24 Feb 2026 11:00:29 GMT
Keep-Alive: timeout=60
Connection: keep-alive

With 4.0.3 we get the following instead:

HTTP/1.1 200
Last-Modified: Tue, 24 Feb 2026 10:55:17 GMT
Accept-Ranges: bytes
Content-Type: text/html
Content-Language: de-DE
Content-Length: 23
Date: Tue, 24 Feb 2026 11:01:16 GMT
Keep-Alive: timeout=60
Connection: keep-alive

According to the release notes of Spring Framework 7.0.5 there is "Attention Required" due to "Optimize request and response header handling in Spring MVC #36334". However, nowhere is stated what has to be done. It is unclear whether this is missing documentation or something simply broke.

Thank you and best regards

Nils