Instances of the class sun.security.pkcs11.wrapper.PKCS11 register a cleaner in the class constructor. The cleaner is never used:
- PKCS11.moduleMap holds a strong reference to the PKCS11 object
- the native PKCS11_connect method creates and leaks a global reference to the PKCS11 object
as a result, the object is never collected, and the cleaner is never run. The issue was also present in earlier JDK versions that used the finalizers.