Cors on Tomcat returns multiple Allow-Origin headers

[Stitch10925]

I have a docker container running PlantUML server Tomcat version on the following address: http://192.168.1.10/
I have a website that makes a post request to the server. With some content in the body:

URL: http://192.168.1.10/png
BODY:
Bob -> Alice : hello2
Steve -> Jonah
Sven -> Miriam
Hans -> Grietje

This should return an image, which works fine in Postman.
However, when performing this post request in the browser using Javascript, the browser blocks the response with a Cors error: Multiple Cors headers are not allowed.

When looking at the response it indeed has 2 Cors headers:

• Access-Control-Allow-Origin: *
• Access-Control-Allow-Origin: http://192.168.1.10/

The first one is the one added by PlantUML server (persumably DiagramResponse.java lines 205 or 122), the second one is added by Tomcat.

When I disable the CorsFilter in Tomcat no Access-Control-Allow-Origin are returned, not even the one from PlantUML. This means I cannot make any POST calls to my local server because I either get no Access-Control-Allow-Origin headers or I get two, both cause the browser to give a Cors error.

Is there a way to stop PlantUML from adding the Access-Control-Allow-Origin header by default? Maybe using a parameter? Or is there a way to configure Tomcat to return only one header?

Tomcat CorsFilter configuration:

<filter-name>CorsFilter</filter-name>
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
<init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>http://192.168.1.10/</param-value>
</init-param>
<init-param>
    <param-name>cors.allowed.methods</param-name>
    <param-value>GET,POST</param-value>
</init-param>
<init-param>
    <param-name>cors.allowed.headers</param-name>
    <param-value>Content-Type,Authorization,Accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Content-Length,Connection</param-value>
</init-param>
<init-param>
    <param-name>cors.exposed.headers</param-name>
    <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
</init-param>
<init-param>
    <param-name>cors.support.credentials</param-name>
    <param-value>false</param-value>
</init-param>