UPDATE: Solution right after question.
Usually, synchronization is serializing parallel requests within a JVM, e.
Another solution suggested in "Murach's Java Servlets and JSP (3rd Edition)" book:
Cart cart; final Object lock = request.getSession().getId().intern(); synchronized (lock) { cart = (Cart) session.getAttribute("cart"); }