I have a vanilla spring boot app that consists of the following pom.xml
It looks like this a bug in Glassfish: GLASSFISH-21265
You can try to get around that by adding metadata-complete="true" in your web.xml like this:
The metadata-complete="true" indicates that the JAR files in /WEB-INF/lib doesn't need to be scanned for Servlet 3.0 specific annotations, but the webapp's own classes will still be scanned.
See also: