undertow with potentially malicious String in StrictHttpFirewall

I have two service (kinda micro) one of which is backed by Tomcat and the other one underow. Latter servers as a proxy to former so one can either request directly Tomcat or proxy through undertow. When I try to download file with arbitrary name with spaces in it's name like Document%20with%20spaces%20in%20name.pdf it works fine on Tomcat but fails on undertow throwing RequestRejectedException from StrictHttpFirewall -> decodedUrlContains -> valueContains(request.getServletPath(), value).

When I check request.getServletPath() value on Tomcat I see decoded servlet path looking like Document with spaces in name.pdf when I debug the same code on undertow I see encoded value of servlet path that is Document%20with%20spaces%20in%20name.pdf.

What's important is that from controller method GetMapping when I return
return CompletableFuture.supplyAsync { ResponseEntity.ok(resource) } it fails with

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "%"

I change return type to
return ResponseEntity.ok(resource)

It works just fine, returning resource with 200 OK.

One would think that it should behave the same on both containers.

Version

spring-sercutiry-web:5.1.3.RELEASE
undertow:2.016

Start with StrictHttpFirewall.decodedUrlContains and valueContains, then trace how request.getServletPath() differs between Undertow and Tomcat for the GetMapping request. Reproduce both the CompletableFuture and direct ResponseEntity return paths; done means the valid encoded filename is handled consistently without an inappropriate RequestRejectedException.