What is Unable to determine dialect of the StAX implementation warning?

[dejank52055655]

I'm getting this warning in the coldfusion-out.log everytime the application restarts. It started after I installed CF2021 update 12 on Centos 7.9. Using mod_jk connector. I've looked in this post: https://community.adobe.com/t5/coldfusion-discussions/weirdness-after-cf-auto-lockdown-tool/m-p/1411... however I did not run the lockdowntool.

Could someone please explain what this package is used for and is this warning something to look into closely?

WARN [main] - Unable to determine dialect of the StAX implementation at jar:file:/CF_HOME/coldfusion2021/appinstance1/lib/bundleaxis/wstx-asl-3.2.9.jar!/

Thank you!

[Charlie Arehart]

While you await a reply from Adobe or someone with more details, I'll share (for you and others finding this) that the warning is NOT limited to Centos, nor even linux, nor related to the lockdown tool (as you confirm).

I see it on every implementation, regardless of OS (at least Windows and Linux. Mac folks might confirm.)

Whether it starts with update 12, I'll say also that I'm pretty sure I saw it before then.

But I realize you (and others) will just want to know a) do you need to worry about anything and b) can anything be done to stop what's causing the warning. I don't have an answer to either. I'll say I've simply ignored the warning since it turned up, and I'm not aware of any negative impact.

Let's see if Adobe or anyone else can offer more. 

[BKBK · Accepted solution]

Streaming API for XML (StAX) is a Java API for event-based reading and writing - that is, for streaming - XML documents. The API consists of readers, writers and iterators, which may be implemented in a variety of ways. Hence the need for a Stax specification. This provides a standard for any API that wishes to implement Stax.  

JSR 173 has been the specification for many years now. If an implementation does not conform to JSR 173, then the implementer may wrap it up in a "dialect" to ensure it does conform. That is why a Java application, such as ColdFusion, would want to know the Stax dialect. There are no security issues pertaining specifically to Stax.

The warning here suggests that ColdFusion was unable to determine the dialect of the Stax implementation, wstx-asl-3.2.9.jar. Nevertheless, wstx-asl-3.2.9.jar may be doing its job just fine. So, if XML works without any problems in your ColdFusion application, then there is nothing for you to worry about.