Skip to main content
M
miki
Known Participant
August 11, 2026
Question

CF 2023 patch 23 packages hash doesn't match provided

  • August 11, 2026
  • 1 reply
  • 33 views

today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion.  I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers. 

 

I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip.  

However the hash published on that page for the packages repository:  (MD5:651E86B76AF4D405EAB2D177EC82EAE3)

“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3)”

does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash.  

Below are the download command, results of my download, the file sizes of downloaded files and the hash results.

command prompt visual with some information removed showing the curl call that downloaded the file, the results of the download, a dir command for all files matching the pattern hot* that returns the two files downloaded, with the relevant file: hotfix-packages-cf2023-023-330940.zip, showing size of 926,087,569  followed by a certutil command that compares the hash to the published “651E86B76AF4D405EAB2D177EC82EAE3” and returns no results and finally a direct certutil command run against the downloaded file that returns MD5 value “2805cb4ace42b63fe8d66a741ece6f8f”

Given the purpose of hashes in security; I am loathe to install code that doesn’t match the published hash unless i have something from Adobe telling me the correct hash.

 

Can anybody either point me to a copy of hotfix-packages-023-330940.zip that matches the published hash (651E86B76AF4D405EAB2D177EC82EAE3) or the correct hash for verifying the “hotfix-packages-cf2023-023-330940.zip”.

Please advise

    1 reply

    Vikram_Kumar_M
    Adobe Employee
    Vikram_Kumar_M
    Adobe Employee
    August 12, 2026

    ​@miki We’ve fixed the issue and verified that the checksum is now correct.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices