I've really come to dislike the term "bad practice", as it insinuates that we can assess whether something is bad irrespective of circumstances. Such is rarely the case - or put differently, if the designers of the Java language had thought static fields to be always bad, they wouldn't have included them in the language.
It's totally ok to have mutable state in a servlet - but you have to keep in mind the servlet container will use the same object instance of the servlet to (concurrently) serve all requests.
This implies that state specific to the request should not be stored in the servlet, because the different request processing threads would overwrite each other's state. In your case though, you want state to be shared across all requests, so a field in the servlet is appropriate. As the servlet is accessed by concurrent threads, you will however have to synchronize access to that mutable shared state.