diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java
index 8ecaedf4fd9..23550a46e04 100644
--- a/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java
+++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java
@@ -1213,6 +1213,7 @@ public class DispatcherServlet extends FrameworkServlet {
 		// leaving the other response headers in place.
 		try {
 			response.setHeader(HttpHeaders.CONTENT_TYPE, null);
+			response.setHeader(HttpHeaders.CONTENT_DISPOSITION, null);
 			response.resetBuffer();
 		}
 		catch (IllegalStateException illegalStateException) {
diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/DispatcherServletTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/DispatcherServletTests.java
index f80c9b4e9d5..baf454092c6 100644
--- a/spring-webmvc/src/test/java/org/springframework/web/servlet/DispatcherServletTests.java
+++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/DispatcherServletTests.java
@@ -898,8 +898,8 @@ class DispatcherServletTests {
 		assertThat(response.getHeader("Test-Header")).isEqualTo("spring");
 	}
 
-	@Test
-	void shouldResetContentTypeIfNotCommitted() throws Exception {
+	@Test // gh-34366, gh-35116
+	void shouldResetContentHeadersIfNotCommitted() throws Exception {
 		StaticWebApplicationContext context = new StaticWebApplicationContext();
 		context.setServletContext(getServletContext());
 		context.registerSingleton("/error", ErrorController.class);
@@ -908,11 +908,15 @@ class DispatcherServletTests {
 
 		MockHttpServletRequest request = new MockHttpServletRequest(getServletContext(), "GET", "/error");
 		MockHttpServletResponse response = new MockHttpServletResponse();
-		assertThatThrownBy(() -> servlet.service(request, response)).isInstanceOf(ServletException.class)
+
+		assertThatThrownBy(() -> servlet.service(request, response))
+				.isInstanceOf(ServletException.class)
 				.hasCauseInstanceOf(IllegalArgumentException.class);
+
 		assertThat(response.getContentAsByteArray()).isEmpty();
 		assertThat(response.getStatus()).isEqualTo(400);
 		assertThat(response.getHeaderNames()).doesNotContain(HttpHeaders.CONTENT_TYPE);
+		assertThat(response.getHeaderNames()).doesNotContain(HttpHeaders.CONTENT_DISPOSITION);
 	}
 
 
@@ -968,6 +972,7 @@ class DispatcherServletTests {
 			response.setStatus(400);
 			response.setHeader("Test-Header", "spring");
 			response.addHeader("Content-Type", "application/json");
+			response.addHeader("Content-Disposition", "attachment; filename=\"report.txt\"");
 			if (request.getAttribute("commit") != null) {
 				response.flushBuffer();
 			}