CF2021 Tomcat < 9.0.98 is this vulnerable to CVE-2024-50379 (9.8)

The key to the Apache Tomcat 9.0.98 fix is the Java version. See https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98 . This documentation tells us that, using the default Java settings implemented in ColdFusion, the issue is only relevant for ColdFusion 2021 or older. They are the ones that use Java 8 and Java 11.

A summary of the fix is:

• For Java 8 or Java 11 (ColdFusion 2021 or older): the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true);
• For Java 17 (ColdFusion 2023): the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false).
• For Java 21 onwards (ColdFusion 2025): no further configuration is required (the system property and the problematic cache have been removed)

In short, if you're on ColdFusion 2021 or older, you can mitigate this issue by adding the flag

-Dsun.io.useCanonCaches=false

to the JVM settings in the jvm.config file.