Spring Security's OnCommitedResponseWrapper does not override the setHeader, setIntHeader, addIntHeader methods. This means that if the Content-Length response header is specified using any of those methods then the response body length is not tracked and can be committed before the response headers are written.

Spring Security should override the missing methods and track Content-Length as is already done for addHeader.

This issue is the underlying problem for spring-projects/spring-framework#36381