HttpSession is keeping a list of packets that need to be delivered to the client. The packets keep a reference to the dom object. In the heap dumps we are seeing that dom objects are the ones that are consuming the memory. With 26K http sessions the server is consuming 700MB. Not bad but not too good either.