HttpsClient extends sun.net.www.http.HttpClient. HttpClient internally uses a lock when dealing with internal state, in methods like putInKeepAliveCache(). The HttpsClient overrides this method and in its implementation it doesn't use the lock when dealing with the "inCache" internal field. This looks like an oversight.