ColdFusion

Hi Just wondering if anyone has any experience with implementing connection retry logic with Coldfusion and Azure sql, to handle transient connection failures. I have an application that is hosted on Azure with Azure SQL and there have been a few instances where the DB has failovered intermittently while a user was requesting a page, thus resulting in an error. Looking to see how I can minimize this impact and make it a seamless experience on the user's end when this occurs. I've looked at https://docs.microsoft.com/en-us/ef/ef6/fundamentals/connection-resiliency/retry-logic which is based on an EF6 library. Thanks!

I just updated CF 2023 from 6 to 15, and applicaton is not working with below error:any idea what's missing? Thanks.Variable HTTP_REFERER is undefinedcoldfusion.runtime.UndefinedVariableException: Variable HTTP_REFERER is undefined. at coldfusion.runtime.CfJspPage._get(CfJspPage.java:456) at coldfusion.runtime.CfJspPage._get(CfJspPage.java:411) at coldfusion.runtime.CfJspPage._get(CfJspPage.java:390) at coldfusion.runtime.CfJspPage._autoscalarize(CfJspPage.java:2364) <CFIF (ReFindNoCase("login/login.cfm",HTTP_REFERER) EQ 0 AND ReFindNoCase("login/login.cfm",SCRIPT_NAME) EQ 0 AND ReFindNoCase("login/action_login.cfm",SCRIPT_NAME) EQ 0)> <CFIF IsDefined("SESSION.LOGGEDIN") and SESSION.LOGGEDIN EQ "TRUE"> <CFELSE> 

We are pleased to inform you that we've released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 2 ColdFusion (2023 release) Update 14 ColdFusion (2021 release) Update 20   These updates resolve several critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution, and security feature bypass. View the security bulletin, APSB25-52, for more information.   Download the updates ColdFusion 2025 updates ColdFusion 2023 updates ColdFusion 2021 updates   What's new in the updates New JVM flags Changes to remote method Refreshed add-on installers Pathfilter changes   Others Bug fixes Known issues   Docker and cffiddle CFFiddle is updated. Docker images of the update are avaiable on Docker hub and Amazon ECR.   Please download and apply the updates and provide your feedback.

hi,  my CF 2023 enterprise license will expire on Nov. 1 2025, I am thinking not to renew because the application is schedule to move to other platform around Dec. 30 2025. Now the question is can my CF server keep up and running until Dec. 30 2025 with expired license? Thanks.David

Hi All,Hoping someone can provide some pointers to solve this.I was successfully running on CF2023 update 11 but when I went to update 14 Apache Tomcat mod_jk connector stopped working - i've reverted back to update 11 and it still doesn't work - the browser returns 403 ForbiddenI've checked my server.xml, worker.properties, mod_jk_vhost.conf a million times and they seem to be correct.  I changed the Port being used by the connector in case that was a problem. I'm seeing in mod_jk.log:[Wed Jun 18 08:31:41 2025] [301783:140594684778048] [debug] ajp_connection_tcp_send_message::jk_ajp_common.c (1368): 0130 63 68 65 2F 32 2E 34 2E 36 32 20 28 55 6E 69 78 - che/2.4.62.(Unix[Wed Jun 18 08:31:41 2025] [301783:140594684778048] [debug] ajp_connection_tcp_send_message::jk_ajp_common.c (1368): 0140 29 20 4F 70 65 6E 53 53 4C 2F 33 2E 33 2E 32 20 - ).OpenSSL/3.3.2.[Wed Jun 18 08:31:41 2025] [301783:140594684778048] [debug] ajp_connection_tcp_send_message::jk_ajp_common.c (1368): 0150 6

Hello - Developer edition of CF 2025 running locally on a Mac (OS = Sequoia 15.5). DMG installer. A CFQuery to an MS SQL Server datasource produces this error message: 'Error Executing Database Query. The sqlserver package is not installed. You can install the package through the CLI package manager (/Applications/ColdFusion2025/cfusion/bin/cfpm.sh) by running the command : install sqlserver.'The Packages section of the CF Administrator shows that the sqlserver package already is installed. Same if I attempt an install via the CLI package manager. I've also uninstalled and re-installed the package. Any thoughts?(The query runs without error on CF 2016 or 2018. The datasource verifies in the Administrator (i.e., the 'OK' message.)

We're in the process of migrating from CF2021 to CF2023, and so far everything has been going well except for getting a REST service registered. Using the same path and service mapping as we did in CF2021 we are getting the following error:Error registering REST service. Please ensure that you have entered a proper mapping and path. Application Calendar could not be initialized. Reason: Cannot invoke "java.lang.Boolean.booleanValue()" because "skip" is null Cannot invoke "java.lang.Boolean.booleanValue()" because "skip" is null In trying to research this, I came across what appeared to be an identical case on the bug tracker (CF-4220013 | Tracker (adobe.com)), which was withdrawn as a duplicate of another issue. However, that other issue (CF-4219459 | Tracker (adobe.com)) loads with a page that says "No issue found." I can't seem to find anything else that helps. Is this an actual bug? Has anyone else run into this? Has anyone else solved it?

Hi everyone,I've been working with the Adobe ColdFusion 2021 AMI on AWS (Windows) and noticed that Docker is installed by default. However, the ColdFusion documentation and AWS Marketplace listing don’t mention Docker as a requirement or dependency.While scanning the instance for security vulnerabilities, we identified two Docker-related CVEs:CVE-2021-21184CVE-2021-21185These are medium to high severity issues affecting Docker Desktop.Questions:Is Docker required for ColdFusion to run properly on this AMI?Can I safely uninstall Docker without impacting ColdFusion functionality?If Docker is required, can I safely upgrade it to the latest patched version?I’d appreciate any clarification or official guidance. I want to ensure we maintain a secure and minimal environment without removing something critical to the ColdFusion runtime.Thanks in advance for your help!Best,

Hello, I would like to know if I have coldfusion 2021 can i upgrade to 2023 without additional cost or a new license is required?

I'm updating a ColdFusion 2021 installation from V.13 to V.14 when V.14 installed the administrator came up except for the pakage manager page, it throws an error, when I look at the exception log I see the following: "Error","http-nio-8544-exec-7","07/08/25","16:33:29","cfadmin","coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object; The specific sequence of files included or processed is: F:\ColdFusion2021\cfusion\wwwroot\CFIDE\administrator\updates\index.cfm, line: 733"java.lang.NoSuchMethodError: coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object;at cf_core2ecfm1148457877$funcGETINSTALLEDUPDATES.runFunction(/CFIDE/administrator/updates/_core.cfm:733).I've restarted the service, flused the felix-cache, even checked the validity of neo-updates.xml and bundlesdependency.json. I'm at a loss.Fortunately this is a testbed instance so I can throw the server away and have my VMWare team cl

My web server is using CF2021 update18 (Log4j version 2.20.0: jmx enabled default: -Dlog4j2.disable.jmx=false).-When I set metaspace = 256, the memory has nearly 2 million elements of org.apache.logging.log4j.core.jmx.LoggerContextAdmin (watched by jmap -dump).-When metaspace = 512, the memory drops to about more than 500 thousand elements.-When disabling jmx (-Dlog4j2.disable.jmx=true, Log4j Starting in version 2.24.0 JMX support is disabled by default), the memory no longer has .jmx.LoggerContextAdmin (as expected to reduce memory). So my question is: When disabling jmx, will it affect coldfusion? (my web server)※I hope it doesn't affect anything my web serverBest regards.

I'm trying to submit a bug report for ColdFusion using the Adobe Bug Tracker ( https://tracker.adobe.com/#/add_bug ) and when I select ColdFusion from the dropdown, the progress indicator just spins and spins.  There are a lot of 400 errors in the console too, so it appears the Bug Tracker has a bug of it's own.   Is this the correct location to report a bug?  Or has it been replaced and is no longer in service? Thank you!

Problem Description: DateFormat is returning a 9 character date instead of an 8 character one.Steps to Reproduce:1. Add the following to any Cold Fusion page:<cfset testDate = DateFormat(Now(),"YYYYMMDD")><cfoutput>Current Now(): #Now()#<br>Test DateFormat: [#testDate#] (Length: #Len(testDate)#)<br></cfoutput>Actual Result:Current Now(): {ts '2025-07-08 13:57:51'}Test DateFormat: [202507189] (Length: 9)Expected Result:Current Now(): {ts '2025-07-08 13:57:51'}Test DateFormat: [20250708] (Length: 😎Any Workarounds: I checked my system clock and it is indeed set to 7/8/2025 (today) so I know it's not the system clock. I also updated Cold Fusion 2023 to the latest update(15) and restarted the server but it didn't help, I still get the same error.Browser Info: Chrome-----------------System Information------------------Time of this report: 7/8/2025, 14:04:50Machine name: ITJN-JHTSY84Machine Id: {921ECBB9-6C70-4E25-A872-0A8995BFE289}Operating System: Windo

On my server, I've got a few scheduled tasks set up. Yesterday, after a while, I wanted one of the tasks to run at a different time. After doing the edits and clicking the "Submit Changes" button, I got this error:Invalid extension of the file name. Valid extensions are :log,txt Didn't have this issue before, so I am not sure what's causing it. Here are the server details:  

Recently a vendor we work with updated their server to support TLS 1.3 in addition to TLS 1.2 and our CFHTTP calls to their API are now failing with an Errordetail "I/O Exception: www.thevendor.net:443 failed to respond" - Testing from our server to theirs using java (11.0.10) SSLPoke succeeds.- Scanning their API endpoint with the SSLLabs testing tool shows no issues.- Accessing their API endpoint with Chrome browser has no issues.- If I modify our code to use the CFX_HTTP5 custom tag, the connection succeeds.- If I add jvm.config flags to force TLS 1.2, the connection succeeds, specifically:-Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 If I enable SSL handshake debugging with the jvm flag-Djavax.net.debug=ssl,handshake,verbosecoldfusion-error.log doesn't show an exception but the last few lines show these lines that I don't see in a successful TLS 1.2 connection:javax.net.ssl|DEBUG|E1|ajp-nio-127.0.0.1-8020-exec-4|2021-03-30 19:44:22.918 CDT|SSLCipher.java:19

Hello,I had Encountered couple of issues after update ColdFusion 2023 Update 5 to Update 10. 1. ColdFusion could not delete the file C:\Request Form1.pdf. . The cause of this exception was: java.nio.file.FileSystemException: Request Form1.pdf: The process cannot access the file because it is being used by another process. <br>The error occurred on line 8.below is the code. When I add the <cfset sleep(500) /> before a file deletion then it works fine.<cffile action="readbinary" file="#filelocation#" variable="clobVar" /><cffile action="delete" file="#filelocation#">2. It seems some of the configuration missed related to custom Java class for below code I am getting an error as "Object Instantiation Exception. Class not found: org.util.pdf.AppendLetterPDFs <br>The error occurred on line 32." for below code. But I am not sure where the Jar or packages mapped or configured.<CFOBJECT ACTION="CREATE" TYPE="JAVA" NAME="appender" CLASS="org.util.

Hi Experts,We recently upgraded our ColdFusion 2023 environment from Update 10 to Update 12. After the upgrade, we encountered an issue in one of our applications that handles PDF uploads and validation.Previously, we used the IsPDFObject(mytempPDFObj) function to validate uploaded PDF files, and it worked as expected. However, after the upgrade, this function consistently returns NO, even though the uploaded files are valid PDFs and were working fine before the update.We confirmed that:The uploaded files have the correct .pdf extension.The same files were successfully validated before the upgrade.mytempPDFObj is being populated correctly but appears to be a struct always, not a PDF object.Has anyone else experienced this issue after Update 12? Is there a change in how ColdFusion handles PDF objects or MIME validation in this update?Any insights or workarounds would be greatly appreciated. Thanks in advance! 

I have a server running 7 instances of CF (6 sites plus root instance).  If I run a NetStat, I generally see about 1800 ports as "ESTABLISHED"  (see below for a sample).  Why so many ports connected to itself? Ultimately what happens is the server just kind of dies because it can't establish any more sockets.  I don't think it's "port exhaustion" because I see the total number of connections staying around that 1800 mark, and there aren't piles of TIME_WAIT entries. What I THINK is happening, is, as this issue is cycling through ports, it gets to a 65535 ceiling and is not looping back to lower ports, thus killing connectivity. Any thoughts on what's going on here? TCP 127.0.0.1:49890 site01-wf:49891 ESTABLISHEDTCP 127.0.0.1:49891 site01-wf:49890 ESTABLISHEDTCP 127.0.0.1:49892 site01-wf:49893 ESTABLISHEDTCP 127.0.0.1:49893 site01-wf:49892 ESTABLISHEDTCP 127.0.0.1:49894 site01-wf:49895 ESTABLISHEDTCP 127.0.0.1:49895 site01-wf:49894 ESTABLISHEDTCP

This is an issue I have on CF2016, but I've tried CF Fiddle and it's the same result on all versions, so I presume it's not a bug. I noticed that calculations were not rounding correctly, for example if the calculation gave a result of 7.875 and  I used NumberFormat to round it to two decimal places, I would have expected it to round up to 7.88 After a lot of playing around, and a few conversations with ChatGTP 🙂 I hacked around and found something unusual, if I change the value to a string, within the NumberFormat, it works. Here is the code for the two tests with and without the ToString. Notice the different in rounding. Am I missing something? It gives me the right answer and I can't seem to break it, but it appears to be an odd way to go about things <CFOUTPUT><b>Test 1</b><br>Before rounding: #aff_payment#<br>After NumberFormat rounding: <b>#NumberFormat(aff_payment,"9999999.99")#</b><br><br&

I'm running 2 Windows 2016 boxes with CF 2018 Ent installed.We have a dedicated CF instance specifically to run as a websocket server.It's setup to proxy via IIS.We estimate that we could have 5,000 - 10,000 concurrent connections to it since our users could be subscribed to multiple channels.After a fresh restart of CF and IIS, clients can connect to the websocket channel instantly and get a near instant success publish from the channel so you know you're successfully subscribed and updates will start coming in.After a random amount of time after things are working well (minutes to days), clients will instantly connect but will no longer get the success publish until things are restarted again. This means they aren't truly subscribed to the channel anymore and no updates come through. The instance resources look fine, good memory usage, garbage collection looks good, low cpu usage. We've also been playing with the connection pool numbers.server.xml max threads = 5000 co

We installed HF 20 on our CF 2021 instance (from HF 19) and saw "Security violation: Scheduled task 'XXX' attempted to execute unauthorized path: F:/Tasks_Logs/xxx.log. To allow it, whitelist the path in cf-root/lib/pathfilter.json against key schedulerexecutionpaths." in the scheduler.log (and consequently the task did not run (actually found the task to be deleted). Anway, based on the release notes, we updated pathfilter.json as such:"schedulerexecutionpaths": "F:/Tasks_Logs/**."Restarted CF and then broke our SAML/SSO login altogether to the site, so the site was hard down. Backed out change to pathfilter.json and restarted CF, still hared down. Backed out HF 20, back to HF 19 and restarted, all good (sans deleted scheduled tasks). Error when hard down, on our consume page (SAML response) looked like:Diagnostics org/hibernate/HibernateException null <br>The error occurred on line -1.GeneratedContent [empty string]HTTPReferer https://subdomain.one

If I leave my page long enough for the user login session to timeout, then reload the page, I get an HTML rendering of the page. Then if I reload it again, the page renders normally. It happens on at least two pages I have tested so far. Firefox gives an engimatic error "SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data", but apart from that, nothing else. I don't know what it's looking at when it says "line 1".Line 1 of the HTML itsef is:<!DOCTYPE html> Before I start deconstructing the page line by line till the error goes away, just wondering if anyone had come across any such thing before. 

I'm curious if anyone testing out cf2025, that uses CKeditor has figured out what to do about the out of date messages that it produces when using ckeditor?   I will probably just convert them all to regular text areas, its just pretty annoying how its not up to date with cf2025.  I'm running a development box using the development version.  

Hello everyone, I'm trying to output my cfquery to array. I need something like this:[code]<cfset myarray=arrayNew(2)><cfloop query="qryCustomers">     <cfset myarray = [{"CustomerID":ID,"Name":FirstLast}]></cfloop>[/code]I tried this code but that did not work. Error always indicate that something is wrong in my cfset where I have my ID and Customer name together. I'm not sure either if I can do this in cold fusion. I have to put these to values together because I have to use them later to compare with other values from second query. If anyone can tell me what is wrong in my code I would appreciate that. Thanks in advance.