With the Spring 4 modularization a part of the errorpage auto-configuration was moved to the spring-boot-web-server module, i.e. when running in war mode the part done by ServletWebServerConfiguration is missing, the ErrorPageRegistrarBeanPostProcessor isn't registered, the default ErrorPageCustomizer isn't applied, and thus the ErrorPageFilter has no default ErrorPage, exceptions won't be fowarded to the ErrorController but bubble up to the Servlet container, which then renders its own error page (which can be critical if it exposes internals).
There are possible workarounds, e.g. always configure the error-page on container level (web.xml), add the webserver-module dependency in war-mode, or manually register the PostProcessor.
But nevertheless this is an undocumented regression coming with Spring Boot 4 which should be fixed soon.