I don't know why this was downvoted. This vulnerability in Jetty was the result of sharing a buffer between requests: http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerabi...

This is a reasonable concern, and as the other response mentions, it has happened, even to well-respected projects. I will however say that there are some ways to combat this if you are in a situation where security is an absolute must. While it removes some of the performance benefits, a simple defense is to include a call to clear the state of the object before letting it out of the pool, or upon returning it to the pool.