Bug Reports

We are using Coldfusion 2023 Update 26 on Windows Server 22.  Yesterday we applied the Update 26 and ended up with bad data in the database, because of “reReplace” no longer working like it used to. We have a function that attempts to capitalize the first character of a string in case the user does not “case” properly.  At the heart of the function is something like this:   rereplace(lcase("test"), '^\w|\s\w', '\U\0','ALL') At update 25, this call would return “Test”, but after applying update 26, it’s returning “UTest”.  Because of this, we had lots of data go into our database with letter U prepended.  This will be a major pain to fix.  I am sure there are other ways to uppercase first letter of a string, but at this point, I haven’t had a chance to look into it.  Just thought I’d post this here so other users are aware.I have filed a bug report with Adobe.  Please upvote so this will get noticed and fixed.https://tracker.adobe.com/#/view/CF-4234761

To reproduce view a log file in the CFAdmin. Correction - This started in update 25.

When using CFChart with an external style file, CF can no longer find it after applying the latest patch.  The error returned is:  Could not locate the style file ../includes/css/currency.piegraph. Current version:  2023,0,24,330957Previous version (which still works):  11,0,19,314546Server:  Windows Server 2019. Code:<cfchart style="..\includes\css\currency.piegraph" chartwidth="500"></cfchart> I have tried using relative path, absolute path, and also ExpandPath() and made sure the file exists but CF doesn’t like it.  We have other servers not yet updated but they can locate the file just fine.  Please suggest a fix. 

No core adobe broken form/link support could be found so I’m posting this here since we need to subscribe to receive alerts/bulletins immediately for CF updates. When I attempt to subscribe to security bulletins here https://www.adobe.com/subscription/adobesecuritynotifications.html I receive an “Invalid Email” when I use a @va.gov email address.  

I installed the update 25 for CF2023 manually. We always install updates on our dev server first which is running CF2023 developer. The update UI didn’t show any issues. After the update some of the packages were removed including cfadmin. Thankfully visiting cfadmin link showed me how to install it from cfpm.bat. I was able to install cfadmin and then from it install the rest of the missing packages.The update log does show timeouts on downloading some packages but the status on this entry is still shown as Successful after the errors.Did someone encounter this issue ? Environment: CF2023 developer on Windows Server 2019 Log entry related to packages:Downloading the package axis-2023.0.25.330977.jarRead timed outDownloading the dependent package sharepoint-2023.0.25.330977.jarRead timed outDownloading the package adminapi-2023.0.25.330977.jarDownloading the package adminapi-2023.0.25.330977.zipRead timed outDownloading the package administrator-2023.0.25.330977.jarDownloading the pack

Photoshop version:27.9.1Steps to reproduce:Open a PSD/document. Place an image and convert it to a Smart Object. Use Free Transform to scale the Smart Object down. Press Ctrl+T again. Choose Distort. Move the four corner handles to create a trapezoid/perspective shape. Press Enter to commit the transformation. The transformed object itself remains in the correct position. However, the Transform bounding box/handles immediately jump to the upper-left corner of the document, completely away from the object. Pressing Ctrl+T temporarily puts the bounding box back around the object, but after pressing Enter it jumps to the upper-left corner again.Expected result:The Transform bounding box should remain around the transformed Smart Object.Actual result:After committing a Distort transformation, the bounding box and transform handles jump to the upper-left corner of the document and no longer correspond to the transformed object's position or dimensions.Additional information:The problem does

On the ColdFusion Downloads Page (https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-downloads.html), the Java updates section is behind by weeks. The most up-to-date Java listed for CF 2023 is 17.0.20, which had a significant security issue and caused version 17.0.20.1 to be released on Aug 18, 2026. It is now 31 days later and the update has not been posted on your page yet, please help us avoid additional conversations with our security folks and post those soon!Screenshot of downloads page Java versions on 9/21/2026:Java Releases:  

implementing CF23 update 24 where it seems to be complaining about the colon in the dbvarname. The procedure name is just PACKAGE.PROCEDURE_NAME I don't see the cause of the problem. Actual error: The value ":v_session_id" contains invalid characters. <cfprocparam dbvarname=":v_session_id" value="#functionHere()#" type="IN" cfsqltype="cf_sql_varchar">

If you have schedule tasks that use CRONtime it would be nice to see that reflected in the Settings Summary.

Updated ColdFusion 2023 from update 22 to update 23. After restarting every instance aside from the cfusion instance would crash upon restarting. In the coldfusion-errors.log, you have two entries: SEVERE: End event threw exceptionjava.lang.NoSuchMethodException: Cannot find method [setChannel] in object [StandardEngine[Catalina]] of class [class org.apache.catalina.core.StandardEngine]    at org.apache.tomcat.util.IntrospectionUtils.callMethod1(IntrospectionUtils.java:541)WARNING: Catalina.start using D:\ColdFusion2023\D1/runtime/conf/server.xmlorg.xml.sax.SAXParseException; systemId: file://D/ColdFusion2023/D1/runtime/conf/server.xml; lineNumber: 117; columnNumber: 19; Error at line [117] column [19]: [Cannot find method [setChannel] in object [StandardEngine[Catalina]] of class [class org.apache.catalina.core.StandardEngine]]No other log files were generated. The cfusion instance operated normally and we were able to uninstall the update. 

There are a few issues with this page that I wanted to report. The ColdFusion Updates download link is not a link, but is formatted as a link (Download and install updates for Adobe ColdFusion (2023 release). Adobe recommends always applying the latest ColdFusion (2023 release) update.) This should link to the ColdFusion 2023 Updates page, but does not. Java SE 17.0.19 has some high-severity issues and Java SE 17.0.20 was released on 7/21/2026 and still has not been posted to the site. Can you please post that? The bottom of the page shows a Document History section that is badly neglected - showing only document updates from 2023!

Today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion.  I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers. I have a secure server, so i cannot use the CF Administrator to install. I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip.  However the hash published on that page for the hotfix and packages repository:“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3”does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash.  Below are the results of my download, the file sizes of downloaded files and the hash results.comman

today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion.  I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers.  I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip.  However the hash published on that page for the packages repository:“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3”does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash.  Below are the results of my download, the file sizes of downloaded files and the hash results.command prompt visual with some information removed showing the curl call that downloaded

I have an interesting case in which the reflection removal heuristic fails. This is an information plaque at the museum entry: Before reflection removalAfter the removal to my astonishment the algorithm removed the white labels, and left the top right side reflections completely unchanged: Removed labels , reflections unchanged.Thanks,Thomas