Allowing such URIs into the server is not always ambiguous, as applications can be written to work using the encoded (non-ambiguous) APIs. The second step, is the ServletHandler.setDecodeAmbiguousURIs ...

The problem is that the packages use reflection API with classes that are not native types (packages shouldn't be using the reflection API to start with as it is inherently unsafe). This was not ...