Java's DFL-style rcache uses MD5 hash, which is the same as krb5-1.14 and earlier. krb5-1.15 uses SHA256. If the same AP-REQ is sent to krb5-1.15 first (which creates a new rcache entry) and then sent to a Java acceptor, Java cannot find a match in the rcache file and accepts it.

Precisely, Java sees 2 entries there: 1st with SHA-256, 2nd the bare one. Java compares them to its own calculation and finds out 1) match the bare one 2) does not match the SHA-256 one, it then concludes the AP-REQ is a different one although sent at the same time.

Two solutions: 1) understand the SHA-256 entry and treat it as a match. 2) discard the SHA-256 entry and treat the bare one as a match.