Known Participant

today's CF 2023 hotfix release may not be showing the correct hash for the hotfix-packages-cf2023-023-330940.zip

Forum|Forum|9 days ago
August 11, 2026
4 replies
32 views

today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion. I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers.

I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip.

However the hash published on that page for the packages repository:

“Hotfix and packages repository - link - (MD5:*651E86B76AF4D405EAB2D177EC82EAE3”*

does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash.

Below are the results of my download, the file sizes of downloaded files and the hash results.

command prompt visual with some information removed showing the curl call that downloaded the file, the results of the download, a dir command for all files matching the pattern hot* that returns the two files downloaded, with the relevant file: hotfix-packages-cf2023-023-330940.zip, showing size of 926,087,569 followed by a certutil command that compares the hash to the published “*651E86B76AF4D405EAB2D177EC82EAE3” and returns no results and finally a direct certutil command run against the downloaded file that returns value “2805cb4ace42b63fe8d66a741ece6f8f”*

Given the purpose of hashes in security; I am loathe to install code that doesn’t match the published hash unless i have something from Adobe telling me the correct hash. Can anybody either point me to a copy of hotfix-packages-023-330940.zip that matches the published hash or the correct hash for verifying the files.

Please advise