WebApplication is not thread-safe

Instance of class org.apache.wicket.protocol.http.WebApplication is not thread safe being shared among several sessions. Concurrent access to it leads to errors because of the following:

1. bufferedResponses field is initialized with a simple HashMap which is not thread safe and can be corrupted when different threads call addBufferedResponse, popBufferedResponse or sessionDestroyed methods concurrently. Here is the stack trace:

[27.03.09 20:55:26:669 MSK] 0000009c RequestCycle E org.apache.wicket.RequestCycle logRuntimeException <Null Message>
java.util.ConcurrentModificationException
at java.util.HashMap$AbstractMapIterator.checkConcurrentMod(Unknown Source)
at java.util.HashMap$AbstractMapIterator.makeNext(Unknown Source)
at java.util.HashMap$KeyIterator.next(Unknown Source)
at java.util.HashMap.analyzeMap(Unknown Source)
at java.util.HashMap.rehash(Unknown Source)
at java.util.HashMap.rehash(Unknown Source)
at java.util.HashMap.putImpl(Unknown Source)
at java.util.HashMap.put(Unknown Source)
at org.apache.wicket.protocol.http.WebApplication.addBufferedResponse(WebApplication.java:639)
at org.apache.wicket.protocol.http.WebRequestCycle.redirectTo(WebRequestCycle.java:201)
at org.apache.wicket.request.target.component.PageRequestTarget.respond(PageRequestTarget.java:58)
at org.apache.wicket.request.AbstractRequestCycleProcessor.respond(AbstractRequestCycleProcessor.java:104)
at org.apache.wicket.RequestCycle.processEventsAndRespond(RequestCycle.java:1181)
at org.apache.wicket.RequestCycle.step(RequestCycle.java:1252)
at org.apache.wicket.RequestCycle.steps(RequestCycle.java:1353)
at org.apache.wicket.RequestCycle.request(RequestCycle.java:493)
at org.apache.wicket.protocol.http.WicketFilter.doGet(WicketFilter.java:355)
at org.apache.wicket.protocol.http.WicketServlet.doPost(WicketServlet.java:145)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:738)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:831)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1443)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1384)
at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:131)

2. Class org.apache.wicket.util.collections.MostRecentlyUsedMap is not thread-safe and can be courrupted when different threads call addBufferedResponse, popBufferedResponse concurrently.