diff -up ./java/org/apache/coyote/http2/HpackDecoder.java.orig ./java/org/apache/coyote/http2/HpackDecoder.java

--- ./java/org/apache/coyote/http2/HpackDecoder.java.orig	2020-12-18 17:16:34.502408251 +0800

+++ ./java/org/apache/coyote/http2/HpackDecoder.java	2020-12-18 17:22:27.675912403 +0800

@@ -72,8 +72,6 @@ public class HpackDecoder {

     private volatile boolean countedCookie;

     private volatile int headerSize = 0;

-    private final StringBuilder stringBuilder = new StringBuilder();

-

     HpackDecoder(int maxMemorySize) {

         this.maxMemorySizeHard = maxMemorySize;

         this.maxMemorySizeSoft = maxMemorySize;

@@ -222,19 +220,17 @@ public class HpackDecoder {

         if (huffman) {

             return readHuffmanString(length, buffer);

         }

+	StringBuilder stringBuilder = new StringBuilder(length);

         for (int i = 0; i < length; ++i) {

             stringBuilder.append((char) buffer.get());

         }

-        String ret = stringBuilder.toString();

-        stringBuilder.setLength(0);

-        return ret;

+        return stringBuilder.toString();

     }

     private String readHuffmanString(int length, ByteBuffer buffer) throws HpackException {

+	StringBuilder stringBuilder = new StringBuilder(length);

         HPackHuffman.decode(buffer, length, stringBuilder);

-        String ret = stringBuilder.toString();

-        stringBuilder.setLength(0);

-        return ret;

+        return stringBuilder.toString();

     }

     private String handleIndexedHeaderName(int index) throws HpackException {

diff -up ./webapps/docs/changelog.xml.orig ./webapps/docs/changelog.xml

--- webapps/docs/changelog.xml.orig	2020-12-18 17:25:29.287714327 +0800

+++ webapps/docs/changelog.xml	2020-12-18 17:30:42.780824782 +0800

@@ -159,6 +159,9 @@

         frame in the input buffer. (markt)

       </fix>

     </changelog>

+      <fix>

+        <bug>64830</bug>: Fix concurrency issue in HPACK decoder. (markt)

+      </fix>

   </subsection>

   <subsection name="Jasper">

     <changelog>