[epou]

The commit c45c9b4 introduced maxLocaleCount with a default of 10. Requests exceeding this limit throw IllegalArgumentException when the application calls HttpServletRequest.getLocale() or getLocales().

First affected versions:

• 9.0.123
• 10.1.61
• 11.0.27

This changes previously working behavior in a patch release. Legitimate customers will experience failures after upgrading because their browsers send more than 10 language entries in Accept-Language.

RFC 9110 §12.5.4 specifies no maximum number of language entries. Browsers allow users to configure multiple preferred languages and may add language-only fallback entries, so exceeding 10 does not necessarily indicate malformed or abusive traffic.

This PR changes the default maxLocaleCount to -1, preserving the previous behavior while retaining the configurable limit for deployments that need it.

The resource-protection rationale for introducing this setting is understandable. However, enabling a restrictive default in a patch release can cause existing applications to fail for valid requests without any application or configuration changes. The exception may also propagate through frameworks that access request locales implicitly, making the impact difficult to anticipate.

[rmaucher]

It is easy to adjust the property. If you want to discuss what kind of default would be more suitable, you can use the tomcat-users mailing list.