Repro: post an application/x-www-form-urlencoded form whose value is a collection or array, e.g. a tags field of ["a&b=c", "d"]. The body comes out as tags=a&b=c&tags=d, smuggling an extra b=c field into the request the downstream service parses.
Cause: UrlencodedFormContentProcessor.createKeyValuePair collects collection and array values with Object::toString and passes them to CollectionFormat.join, which encodes the field name and the separator but writes each value verbatim. The scalar path already runs values through encode, so only collection-valued fields leak reserved characters.
Fix: encode each collection value with the same encode(value, charset) helper before the join, matching the scalar path. QueryTemplate is the only other CollectionFormat.join caller and already passes pre-encoded values, so join itself is left untouched. Added regression tests for the array and collection paths.