After upgrading our application to Spring Boot 4.1.0, requests started failing once the service was running behind an AWS Network Load Balancer (NLB) configured with a TLS listener. The same build worked before the upgrade.

Our setup terminates (offloads) TLS at the NLB via a TLS listener, and the connection from the NLB to the target group is plain, non-TLS. The application runs on AWS Fargate behind that target group.

The puzzling part is that the failure is specific to HTTP/2. Requests over HTTP/2 get rejected at the protocol level (the stream is reset), while the same requests over HTTP/1.1 work fine.

Works (HTTP/1.1):

❯ curl --http1.1 http://example.com/actuator/health
{"groups":["liveness","readiness"],"status":"UP"}

Broken (HTTP/2):

❯ curl --http2 --http2-prior-knowledge http://example.com/actuator/health
curl: (92) HTTP/2 stream 1 reset by server (error 0x1 PROTOCOL_ERROR)

Nothing in our application code changed in a way that should affect this. Increasing the log levels of spring boot all the way up to TRACE does not reveal any real pointers unfortunately.