Questions

Did anyone hear anything from CF Team about this ? https://www.cve.org/CVERecord?id=CVE-2025-66516 Resolution suggests updating files to version 3.2.2 from 1.2.x found in CF. Posting here as its flagged critical ? is anyone else also seeing this.

I'd like to restrict Jetty access to the server itself only (CF2021).  I need to do this because the port, 8993, is coming up on a security scan.  I can't use Windows Firewall to block the port (it's complicated, but long story short, it's not an option). I have found two places to do this, I think: [cf]\cfusion\jetty\start.ini## Connector host/address to bind to # jetty.http.host=0.0.0.0 ## Connector port to listen on jetty.http.port=8993I'd change the 2nd line to jetty.http.host=127.0.0.1.  Would this cause any problems?  I did this in my test environment and the server seemed fine.  We don't use Solr; we do use PDF generation, and PDFs still generated after I made this change. [cf]\cfusion\jetty\etc\jetty-ipaccess.xml<Configure id="Server" class="org.eclipse.jetty.server.Server"> <Call name="insertHandler"> <Arg> <New id="IPAccessHandler" class="org.eclipse.jetty.server.handler.IPAccessHandler

Hi Team, Recently, we migrated our application from CF2021 to CF2023. Post-migration, we are facing issues with the  tag, which is not working as intended. Below is a code snippet, and it is working in CF2021, but the same is not working in CF2023. Test PDF Data... ​ CF2021: CF2023: Currently, the application is running on CF2023 Update 16. Verified "PDF Service Managers" is enabled. Additionally, I cleared the felix-cache, reinstalled the "htmltopdf" package and restarted the services, but no luck still getting the same error. What am I missing here? Experts, please share your thoughts. Thanks in advance. Regards,Bala.P

I'm currently from ColdFusion 2021 to 2023 and have encountered what appears to be a breaking change in how ColdFusion handles boolean values when interfacing with Java methods and MongoDB operations. The Issue:In ColdFusion 2021, I could pass native ColdFusion boolean values (true/false) directly to Java methods and MongoDB queries without issues. However, in CF 2023, the same code throws errors unless I explicitly cast the booleans using javacast("boolean", true). Example:<!-- This worked in CF 2021 but fails in CF 2023 --> <cfset mongoQuery = {"active": true, "$exists": {"field": true}} /> <!-- Now requires explicit casting in CF 2023 --> <cfset mongoQuery = {"active": javacast("boolean", true), "$exists": {"field": javacast("boolean", true)}} /> 

Hi,i use this code in CF2023<cfscript> params = { field1 = true }; foo(args=params); void function foo(required struct args) { if (arguments.args?.field2) { writeOutput("entra"); } else { writeOutput("non entra"); } } </cfscript>but i receive error Cannot invoke "Object.getClass()" because "x" is nullin first time, after only java.lang.NullPointerException In CF2025 continue with previuos error Am I doing something wrong or is this a bug?

Hi, I am getting the following error message as I try to install the Trial version of ColdFusion 2025 GUI WWEJ Win64 on a Windows Server 2025 (VMware) : "This application has Unexpecedly Quit  Invocation of this Java Application has cause an Invocation TargetException. This application will now exi (LAX)." - The server already has CF2021 installed and I am trying to install CF2025 as a distinct installation.- I have also installed JDK 25 as I thought it was a pre-requisite to have JDK 17 or higher installed but I still get the same error.- I have disabled the Anti-virus hoping that it may help - still get same error message Below are the details regarding the erro message I get: I tried creating a "Package" from the Admin Console (FRL Online) but the zip file I get doesn't get me anywhere... I get a successfull Installation message but CF2025 is nowhere to be found.  Installation sure have changed since I installed CF2021!! ... and not necessarily for the better! I am clueless and any

Let me start, I do know about the changes in Update 14 related to "extra" arguments, and this is not the same issue, but I think it might be related.  The error is that a paramerter can not be found when making a call to a remote function in a CFC.   Here is the top of the function definition:    <CFFunction name="getTable" access="remote">      <CFArgument name="Datasource" required="yes">      <CFArgument name="Username" required="yes">      <CFArgument name="Password" required="yes"> I am getting an error about " The DATASOURCE parameter to the getTable function is required but was not passed in.".   Where this gets more complicated is that we encrypt all the data in our URL's.  So the call to the CFC looks like:https://server/AgentListPolicies.cfc?EUDATA=... encrypted string .... Then during the processing of application.cfm, we take the encrypted string,

Hi everyone,I’m trying to better understand how install ColdFusion on Linux as a non-root user.From what I know, ColdFusion shouldn’t be run as root for security reasons — instead, it should run under a restricted “runtime user” (for example, cfuser or nobody). However, in our environment, system administrators don’t want developers like me to have sudo or root privileges, even for managing the ColdFusion service (start, stop, restart).Here’s where I’m a bit confused:• What’s the proper relationship between the runtime user that ColdFusion runs as and the user account that manages (starts/stops) ColdFusion?• If ColdFusion is owned by a restricted runtime user, can another non-root user safely manage it?• And how would this work for multiple ColdFusion instances (not just cfusion)?I’d appreciate examples or best practices on how others have implemented this setup — especially on RHEL servers.Thanks in advance for any insight or documentation links you can share!

Hi,I've posted here before.If you've read any of my requests for help, you know I am not a programmer.I have a 10-year-old PC that is about to die.  I have Dreamweaver CS 5.5 installed on it.  Even if I could find my license key (I think I can), I cannot get the install number reset, as Adobe no longer maintains that.I rarely use it, but rely heavily on its ability to help with the code.I cannot afford, or justify, a monthly fee for something I might not use for a month or two.Does anyone have a suggestion for an alternative that is user-friendly for someone like me?Thanks

Typing # gives ## - fine for writing code but not for editing. How do I turn it off. 

I am currently implementing an API using the OAuth2: Client credentials authentication.  The oauth is working to a degree but when after API manager proxies the request to the Coldfusion endpoint, it is removing the authorization header.  Is there any way to preserve the header?  My main reasoning is that I need a way to identify the user on the CF server side after going through API manager.  Thanks in advance.

Hello all, I am having an issue with ColdFusion 2023 where exporting to Excel only fails when the AppDynamics Java Agent is enabled. As soon as I add this JVM argument -javaagent:C:\AppDynamics\JavaAgent\ver25.6.0.37159\javaagent.jarmy excel export fails and which results: 500 - Internal server error. If I remove that line and restart ColdFusion services, the export works perfectly again.I think the issue here is AppDymanics agent is interfering with ColdFusion's functionality. Has anyone  esle run into this with CF 2023 and AppDynamics, or is there any known conflict between these two? any adivce, tips or shared experience would be really helpful.  Thanks  

We're getting an error running a CF scheduled task. The error says "Attribute validation error for tag CFSTOREDPROC.-It does not allow the attribute(s) DBTYPE.The valid attribute(s) are  BLOCKFACTOR,CACHEDAFTER,CACHEDWITHIN,CACHEID,CACHEREGION,CLIENTINFO,DATASOURCE,DBPOOL,DEBUG, FETCHCLIENTINFO,PASSWORD,PROCEDURE,RESULT,RETURNCODE,TIMEOUT,USERNAME." However there are NO references to DBTYPE in the whole of the code! Other stored procs run on same server same db connection without a problem. cfstoredproc procedure="namehere" datasource="ourdb"Anyone experienced this?

Hi all, I've just purchased a ColdFusion 2025 Standard Edition license, and activated my trial version. From my understanding, it should be valid for one year. However, in the ColdFusion admin panel, the license is showing as valid only until October 20, 2025 which is just three months from now (see screenshot below). Does anyone know if this is a standard issue, or if there might be a problem with the license activation? I've written to Adobe but I'm not sure when I'll get their reply. Any insights would be greatly appreciated! Thanks in advance.Simon  

Hi,In previous CF versions I had TTF fonts registered in "Font Management" for "Barcode Printing" purposes in a cfdocument without issues. The font shows the same name “without spaces” for all 3 options “Font Family”, “Font Face” and “Postscript Name” and I use that name as in-line CSS style to show barcodes on generated PDF’s.Now in CF 2021, I cannot make them work.So far, I have tried:Multiple installs in "Font Management" with different paths, making sure folders did not have user’s restrictions (permissions), using different fonts; and making sure they show as usable in PDF/FlashPaper column.Install font also in Windows.Restart CF Services.Restart physical server.Convert font to WOFF (Shows in browser using CSS @11220649-face / in-line styling) but does not work inside the cfdocument.Any other suggestion to fix this in cfdocument?

Hi,We are experiencing this cache issue, we have 4 instances and one instance, we have this issue, We manually cleared the cache and uncheck all the cache options and restarted the service but still we got issue, Any help would be greatly appreciated<cfquery name="abc" datasource="#xyz#" cachedwithin="#createtimespan(0,1,0,0)#"> 9 : SELECT test_column 10 : FROM tast_table  Error : Cache initialization failed due to following reason: Error configuring from null. Initial cause was Cannot invoke "java.net.URL.openStream()" because "url" is nullStack Traceat cffacilities2ecfm1461612999.runPage(D:/web/live/mercury/view/facilities.cfm:8)coldfusion.tagext.io.cache.CacheExceptions$CacheInitializationException: Cache initialization failed due to following reason: Error configuring from null. Initial cause was Cannot invoke "java.net.URL.openStream()" because "url" is null at coldfusion.cache.ehcache.GenericEhcache.getCacheManager(GenericEhcache.java:418)

Hello Community,I have inheritted some ColdFusion servers (2021). That has been running great so far but recently, I encountered an odd issue with one of the servers. The issue is that the server stopped processing requests on all instances, whether from websites, APIs, etc. I have tried a number of actions to get this server to start processing requests but all actions have been proven futile at this point.Steps I've taken: rebooting the serverresetting the IIS (restart all coldfusion services) recreate the IIS connectors (restart all coldfusion services) Ensure all services are running Upgrading to the latest available patch (22) on all instances Tried creating a new cluster and instance I've given elevated permission to the IIS user (IUSR) for all sites Verified certs Verified Handler mappings I checked all possible logs (server, application, exception, etc) but can't find anything that would indicate the error. Check event mana

I've read the EULA and read notes about the license in the  ColdFusion End User Licensing Agreement (EULA), and my understanding (which may be wrong) is its one license per VM with a maximum of 8 cores.My current cf enterprise is a vmware instance with less than 8 cores has one ColdFusion server running 2 enterprise instances on different ports. Its configured in an HA config and I hae a second server similarly configured usign cluster configuration.I am working through 2 phases of this to migrate 206 to 2023 to AWS AMI,  then once everythig is up and running turn it to a containerized solution using AWS ECS or EKS:1. I'm moving CF 2016 to an Coldfusion 2023 on aws linux with 2-4 CPU with a single core per CPU until I can develop the resource configuraiton for AWS ECS.2. After we migrate the server to the new environment I'll be building a containerized solution where each enterprise intance  will be its own container.Creating the same configuration isn't a problem

I understand that bytecode execution limitations were introduced with the Hotfixes earlier this year (2025), but I am suddenly running into new problems with this. I have recently been trying to implement CF Enterprise 2021 Hotfix 22 over a successful install of Hotfix 21, and I have got it working on a local instance of Tomcat for Windows. However, when I move the WAR file to Tomcat on Azure, I run into this error opening the Administrator: "ColdFusion, by default, disables the execution of bytecode in .cfm and .cfc files. To enable it, open the JVM.config file, and set -Dcoldfusion.compiler.block.bytecode=false or add path: (here it lists the path to my CF Admin)/CFIDE/adminapi/security.cfc to bytecodeexecutionpaths key of root/lib/pathfilter.json" I don't get this error locally. I've tried adding the path to pathfilter.json, and even to pathfinder.txt when that didn't work, and restarting the service. The error has persisted, and I can't get into the Administrator. Ob

Hello, everyone. About a week ago, our SA and DBA started a migration from CF2021 to CF2023, we are experiencing a couple of odd issues, and the weird thing is - it's limited to just one project.  No other projects are experiencing these issues.  The issue is in our custom built Workflow application. One issue is with setting an identifier for a user using data pulled from the user's Common Access Card (CAC).  We are pulling the DoDID (lastName.firstName.middleName[.cadenceName].EPIDnumber) and I'm getting the 10 digit EPID from this string that is in the CGI scope. <cfset session.userepid = REMATCH("\d{10}",cgi.SSL_CLIENT_S_DN_CN)[1] />The number that is in the DoDID can be either a 10 digit number, or a 16 digit number.  So I'm looking for all 10 digit numbers and taking the first position in the array as the desired number.  This is the actual EPID.  But I'm getting an error that position 1 of the array doesn't exist.  I can ou

Hi, all. I will be installing CF2023 side-by-side with CF2021 on an important server soon, and I have some questions related to my particular situation that I have not been able to answer by searching the Web:  In the CF2023 Administrator, in Package Manager -> Settings, there are Proxy fields at the bottom. After installing CF2023 on other servers, I find that Proxy Username (admin) and Proxy Password (*******) are already filled on first access of the page, and yet I don't know of anywhere that I specified them during CF2023 installation. Can anyone tell me what this magic password is, and where the Username/Password came from? I'll be using the standard GUI exe installer and specifying the Server Configuration (No J2EE). Should I run the installer as administrator? When installing CF2023 side-by-side on other machines, I was at some point offered the option to import the admin settings from CF2021. Can I expect that option every time I install CF2023 side-by-s

Hi all. I've been asked by a client to upgrade a production server from CF2021 to CF2023. While researching the existing server configuration, specifically what "server profile" is being used for CF2021, I was able to find in the original installation log that "Development Profile" was chosen. I'm hesitant to choose "Production" as the server profile when I do the CF2023 upgrade, as I'm not sure what unexpected effects this may have on the application. Regarding this, does the choice of "Server Profile" during installation only serve to appropriately pre-configure various CF Admin settings? If so, the CF Admin settings made in the years after initial CF2021 installation, which will be copied to the CF2023 installation, should suffice even if I choose "Development" as the server profile during CF2023 installation. If it affects more than Cf admin settings, I'd like to know necessary details about it. Thanks! 

How can I host a Static coldfusion website for free?

We have recently migrated our Coldfusion 2021 environment to Coldfusion 2023 on Windows Server 2022 using Oracle JDK 17.0.16.  We've noticed that on Coldfusion 2023, whenever we restart the server, there is a chance that each instance will generate a JVM error log & dump file in Coldfusion2023\instance_name\bin.  The log (named in the pattern hs_err_pidXXXX.log, where XXXX is a 4 digit number) reports an EXCEPTION_ACCESS_VIOLATION (see the error details at the bottom).  Also, a 1gb+ memory dump file named hs_err_pidXXXX.mdmp is generated. We have various ideas for strategies on how to clean up these files, but are concerned that they are an indication of some problem in our CF2023 environment.  So far, we have not seen any indication that the environment is unstable, and the files only generate when the server is rebooted - not when manually shutting down CF services.  We use the Adobe provided Oracle JDK build, but have reproduced this with Redhat Ope

Hi,The issue I have is that I have a bunch of emails that were undelivered because the password of the email addresse used for CFMail was changed.  I was not aware of the problem for a day or so.   So, there a bunch of undelivered emails.  I am able to update the password and CFMail on webpages are now working. SI would like to resend the undelievered mails. From the Administration portal, Server Settings, Mail section, I can "respool" undelivered mails.When I "respool" an undelivered mail, it will disappear from the listing, but will reappear a few minutes later.  I tried manually moving an undelivered mail from the "Undelivr" folder to the "Spool" folder.  The .cfmail file will move back to "Undelivr" folder a few minutes later. Opening up one of the .cfmail file, I saw that there is a password on the file. So, I found correct "password" from the .cfmail file in the Spool folder by triggering a webpage that uses CFMail to send em