Request URL containing semicolon is getting rejected after adoption of spring-security-web version 6.2.8

Describe the bug
Our microservice gateway-ms 3.2.x version is using spring-boot-starter-security version : 3.2.10 which brings spring-security-web version 6.2.6(which has 1 vulnerability)
Our microservice gateway-ms 3.3.x version is using spring-boot-starter-security version : 3.2.12 which brings spring-security-web version 6.2.8

The gateway ms routes the requests to downstream ms e.g. registry-ms

The endpoint https://gateway-route/registry-ms/v1/info/authorities;jsessionid=1234 works perfectly fine with gateway-ms 3.2.x version

But the same endpoint fails with gateway-ms 3.3.x version and gives following error:

05:49:20.033","level":"DEBUG","logger":"org.springframework.security.web.server.firewall.HttpStatusExchangeRejectedHandler","message":"Rejecting request due to: The request was rejected because the URL contained a potentially malicious String ";"","exception":"\norg.springframework.security.web.server.firewall.ServerExchangeRejectedException: The request was rejected because the URL contained a potentially malicious String ";"\n\tat org.springframework.security.web.server.firewall.StrictServerWebExchangeFirewall.rejectedBlocklistedUrls(StrictServerWebExchangeFirewall.java:583) ~[spring-security-web-6.2.8.jar:6.2.8]\n\tat org.springframework.security.web.server.firewall.StrictServerWebExchangeFirewall.lambda$getFirewalledExchange$6(StrictServerWebExchangeFirewall.java:187) ~[spring-security-web-6.2.8.jar:6.2.8]\n\tat reactor.core.publisher.MonoCallable.call(MonoCallable.java:72) ~[reactor-core-3.6.12.jar:3.6.12]\n\tat reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:128) ~[reactor-core-3.6.12.jar:3.6.12]\n\tat reactor.core.publisher.MonoFlatMap.subscribeOrReturn(MonoFlatMap.java:53) ~[reactor-core-3.6.12.jar:3.6.12]\n\tat reactor.core.publisher.InternalMonoOperator.subscribe(InternalMonoOperator.java:63) ~[reactor-core-3.6.12.jar:3.6.12]\n\tat

To Reproduce
MS which is using spring cloud security and working as api gateway based on spring cloud framework is encountering this issue.

Expected behavior
We upgraded dependency spring-boot-starter-security to version 3.2.12 to fix security vulnerability coming from spring-security-web 6.2.6
But the spring-security-web 6.2.8 has caused BWC as endpoints are failing with 400 BAD request.

We dont want to override the bean to disable check firewall.setAllowSemicolon(true);
We are looking for configuration property which can handle this behavior or allows disabling of this StrictServerWebExchangeFirewall.java

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Start with StrictServerWebExchangeFirewall.java, especially rejectedBlocklistedUrls and the reported 6.2.8 behavior, then reproduce the semicolon request through the Spring Security gateway setup described. Determine the supported configuration approach and add coverage for the request and resulting behavior; done means the intended configuration is documented and tested without requiring a custom firewall bean.