The result set on line 148 is never closed (not related to your problem though).
I think the issue is that you aren't closing the statements in the while(rs.next()) loop as they are used. On line 199 you close the ResultSet but not the PreparedStatement. In each loop you are getting another prepared statement on line 186 but you only close it outside of the loop.
I haven't ever used jdbc quite like that though. I always have the db calls wrapped up by a DAO / template that does the following steps:
1. Generate sql / read information from the criteria object.
2. Prepare statement.
3. Bind variables.
4. Execute query.
5. Build object(s). -- this may involve other calls that follow these steps
6. Finally clause that closes the one ResultSet and PreparedStatement.
ResultSet, Connection, PresparedStatment are all considered to be curosrs here.
1. Yes. As Velu pointed out, the code creates n(n is the size of the 'rs') PreparedStatement objects, but closes only one.
2. Also at line no 162, you are reusing the ResultSet object before closing its previously assigned ResultSet object.