Whatever message this page gives is out now! Go check it out!
ColdFusion (2023 release) Update 17
Last update:
Jun 3, 2026
ColdFusion (2023 release) Update 17
Security recommendations
For all security updates, Adobe recommends applying the security configuration settings outlined on the ColdFusion Security page and reviewing the respective Lockdown guides.
Note:
The updates below are cumulative and contain all updates from previous ones. If you are skipping updates, you can apply the latest update, not those you are skipping. Further, you must take note of any changes that are implemented in each of the updates you are skipping.
View ColdFusion (2023 release) Updates for more information.
What's new and changed
ColdFusion (2023 release) Update 17 (release date, 9 December, 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file system write, arbitrary file system read, arbitrary code execution, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 9.0.111.0.
View the security bulletin, APSB25-105, for more information.
Note:
If you have added custom entries to the pathfilter.json file, you must either:
- Back up the pathfilter.json file before applying the update, or
- Restore it from the update backup after applying the update.
The backup copy of the file can be found at: hf-updates\hf-2023-00017-330864\backup\lib\pathfilter.json
New JVM flags
- -Dcoldfusion.websocket.selector.validation
- -Dcoldfusion.deserialization.safeguard.enabled
- -Dcoldfusion.pdf.ddx.allowExternalEntities
- Renamed -Dcoldfusion.datasource.blocked.properties to -Dcoldfusion.datasource.allowed.properties
See JVM arguments in ColdFusion 2023 and 2021 update releases for more information.
Changes to
ColdFusion blocks all class deserialization by default.
From this update, ColdFusion blocks all class deserialization by default. ColdFusion applies a default‑deny deserialization policy using an internal allowlist of classes required by the platform and the cfusion/lib/serialfilter.txt file, which you can edit to whitelist additional safe classes or packages. Classes not on this allowlist are blocked, and an error is logged advising you to add the relevant class or package to serialfilter.txt if you wish to allow it.
When a class is blocked, ColdFusion logs a clear message in both server.log and exception.log, for example:
Error","http-nio-8502-exec-1","11/12/25","11:34:20","", "Due to security reasons, java.util.HashMap is blocked for deserialization. Add the class/package in the file cfusion/lib/serialfilter.txt to override the behavior and allow deserialization."
Error","http-nio-8502-exec-1","11/12/25","11:34:20","", "Due to security reasons, java.util.HashMap is blocked for deserialization. Add the class/package in the file cfusion/lib/serialfilter.txt to override the behavior and allow deserialization."
In case you want to debug further, the stack trace will be in exception.log
If required for backward compatibility or troubleshooting, you can temporarily restore the previous, less restrictive behaviour by setting -Dcoldfusion.deserialization.safeguard.enabled=false. This option is intended only for non-production use and is not recommended for production environments.
Earlier in JEE deployments, the serialfilter.txt file was not functioning, and administrators had to rely on the -Djdk.serialFilter JVM option instead. This limitation has been addressed, and serialfilter.txt is now functional in JEE deployments. If both configurations are present, the -Djdk.serialFilter setting continues to take precedence over serialfilter.txt.
CAR migration changes
ColdFusion Archive (CAR) creation and deployment now honor path allow‑lists defined in <cf_home>/cfusion/lib/pathfilter.json.
- CAR deployment (car.deploypath)By default, no CAR file can be deployed from any path.
- The source paths from which CAR files may be deployed must be explicitly whitelisted under the car.deploypath key in pathfilter.json.
- If a CAR is deployed from a non‑whitelisted path, deployment fails and an error is logged in car_deploy.log, for example:"Error","","10/29/25","10:14:41","","The path \\localhost\c$\new12.car is not whitelisted in pathfilter."
- CAR creation (car.associatedfiles)
- Files and directories included in a CAR as “Associated Files/Dirs” are now checked against the car.associatedfiles allow‑list in pathfilter.json.
- Non‑whitelisted files/directories are skipped when building the CAR and are logged in car_archive.log.
- The CAR build still completes, but unsafe or non‑allowed content is not bundled.
Configuration format
To configure allowed paths for CAR operations, use the following structure in pathfilter.json:
"car": {
"deploypath": "",
"associatedfiles": ""
}
"deploypath": "",
"associatedfiles": ""
}
You can also deploy CARs from shared locations, as long as those locations are explicitly listed in car.deploypath.
New Tomcat version
The update includes a new version of Tomcat, v9.0.111.0
Bugs fixed in the update
| Bug ID | Description | Component |
| CF-4227542 | cfindex could no longer index .docx (and .xlsx) files in ColdFusion after the July 2025 updates, due to a breaking POI/XMLBeans upgrade, producing errors like “Cannot resolve type for handle … code 13”. | Solr |
| CF-4227360 | After the July updates, the ColdFusion mail package developed an OSGi/Felix-cache–sensitive bug where cfmail would start failing (often after restarts) with mail-signing/crypto errors. | Mail package |
| CF-4224509 | Mail signing (cfmail with signing enabled via Admin keystore) failed in ColdFusion due to classloader conflicts in BouncyCastle, causing a ClassCastException between X500Name and ASN1Encodable during S/MIME signing. All signed mails ended up in Undelivered, and the only workaround was to turn off signing. | Mail package |
| CF-4225874 | The val() function started returning a value that evaluated as true in boolean contexts, even for val("") and val(0), which should logically behave like numeric zero and thus be false. | Language |
| CF-4227841 | On the previous update, the Export PDF button on the Licensing & Activation > Usage page did not work as expected. Clicking it produced a client‑side error (EncodeForJavaScript is not defined) and did not generate a PDF. | Administrator |
| CF-4227528 | After applying the previous update, existing clustered scheduled tasks stored in a database stopped working: they no longer displayed correctly in CF Admin (showing errors like ISVALIDPUBLISHPATH is undefined) | Scheduler |
| CF-4227343 | Using createObject() to load certain Java classes from CF packages (e.g., Document/PDF’s dependency jars) caused the Document and PDF packages to silently roll back to the base version. | Administrator package |
| CF-4226957 | In ColdFusion 2023, applying Update 14 (or later updates such as 15) without having applied Update 11 first left Solr stuck at version 8.11.2, even though Update 11 introduced Solr 8.11.3. The installer logic for these updates did not upgrade solr.war if Update 11 had been skipped. | Solr |
| CF-4226953 | On ColdFusion servers with multiple instances, the HTML to PDF (PDFg) service worked for only one instance at a time. The instance that most recently had its PDFg service updated could generate PDFs via htmltopdf, while other instances returned blank pages. Reconfiguring PDFg for a second instance made that instance work but broke the first, making multi‑instance cfhtmltopdf usage unreliable. | HTMLToPDF package |
Known issues in the update
cfpdf
The cfpdf tag’s archive action currently fails when targeting the PDF/A‑2b standard. Attempts to archive PDFs to PDF/A‑2b can throw a NullPointerException in the internal metadata processing instead of completing successfully.
Serialization
In this update, the deserialization safeguard can affect two areas:
- First, on ColdFusion 2021 running with an older Java 11 build, logging of blocked deserialization does not work correctly (you may see warnings that ObjectInputFilter is not available), so you should run on a latest Java 11 to get proper error logging.
- Second, for security reasons we have blocked java.io.Serializable by default, which may affect features such as ORM, Hibernate, or EhCache. Code paths that uses deserialize Serializable[] may fail with errors such as:
"Due to security reasons, java.io.Serializable; is blocked for deserialization. Add the class/package in the file cfusion/lib/serialfilter.txt to override the behavior and allow deserialization."
As a workaround, allow java.io.Serializable in cfusion/lib/serialfilter.txt
Behavior changes
To address scope injection vulnerability, ColdFusion has updated scope precedence to protect non-user-controlled scopes. For a complete list of reserved words in CFML, see Reserved words and reserved variable names in ColdFusion.
Prerequisites
- On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
- If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
- http.proxyHost
- http.proxyPort
- http.proxyUser
- http.proxyPassword
- For ColdFusion running on JEE application servers, stop all application server instances before installing the update.
ColdFusion JDK flag requirements
COLDFUSION 2023 (version 2023.0.0.330468) and above
For Application Servers
On JEE installations, set the following JVM flag, " -Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**; !com.mysql.cj.jdbc.interceptors.**;!org.apache.commons.collections.**;", in the respective startup file depending on the type of Application Server being used.
On JEE installations, set the following JVM flag, " -Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**; !com.mysql.cj.jdbc.interceptors.**;!org.apache.commons.collections.**;", in the respective startup file depending on the type of Application Server being used.
For example:
- Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file
- WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file
- WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone installation.
Installation
ColdFusion Administrator
In Package Manager > Packages, click Check for Updates in Core Server.
After it detects an update, click Update. The core package gets updated the the latest update.
All installed packages also get updated.
Restart ColdFusion for the changes to take effect.
Install the update in offline mode manually
- Download the hotfix installer from the link.
- Download the packages zip file from this link and extract its contents to a location accessible to all ColdFusion server instances.
- Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerRepositoryUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.
You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.
- Windows:<cf_root>\jre\bin\java.exe -jar <InstallerRepositoryUnzippedPath>\bundles\updateinstallers\hotfix-017-330864.jar
- Linux-based platforms:<cf_root>/jre/bin/java -jar <InstallerRepositoryUnzippedPath>/bundles/updateinstallers/hotfix-017-330864.jar
If the core server hotfix installation is successful and if there are errors or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).
Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.
Install the update from a user account that has permissions to restart ColdFusion services and other configured webservers.
For further details on manually updating the application, see the help article.
Note:
If you are on Java 17.0.8 or higher and want to apply the Hotfix manually, use the flag java -Djdk.util.zip.disableZip64ExtraFieldValidation=true -jar hotfix.jar.
However, if you are applying the update from the Administrator, you do not require any flag.
Post installation
Note:
After applying this update, the ColdFusion build number should be 2023,0,17,330864
Uninstallation
To uninstall the update, perform one of the following:
- In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
- Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2023-00017-330864/uninstall /uninstaller.jar
If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:
- Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
- Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2023-00017-330864}/backup directory to {cf_install_home}/{instance_name}/
Note:
Uninstalling this update only removes the core update itself. Any ColdFusion packages that were updated as part of this release remain at their latest compatible versions. If you need to revert package versions, you must do so separately; uninstalling the core update does not roll back package versions automatically.
Q: If I uninstall ColdFusion 2023 Update 17, will all the packages installed with it be rolled back?
A: No. Package rollback depends on the minimum core dependency of each package:
A: No. Package rollback depends on the minimum core dependency of each package:
- Packages with a minimum core dependency of update 17 (that is, they specifically require this core level) are rolled back when you uninstall this core update.
- Packages with a minimum core dependency of update 16 or update 15 remain installed at their latest compatible versions and are not rolled back automatically when you uninstall the core update.
Connector configuration
| 2023 Update | Connector recreation required |
| Update 17 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 16 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 15 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 14 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 13 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 12 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 11 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 10 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 9 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 8 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 7 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 6 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 5 | Yes |
| Update 4 | No |
| Update 3 | No |
| Update 2 | No |
| Update 1 | No |
Package updates
| Update | Packages updated |
| Update 17 | Yes
|
| Update 16 | Yes
|
| Update 15 | Yes The following packages are updated:
|
| Update 14 | Yes The following packages are updated:
|
| Update 13 | Yes The following packages are updated:
|
| Update 12 | Yes The pmtagent package is updated. |
| Update 11 | Yes |
| Update 10 | No |
| Update 9 | No |
| Update 8 | Yes |
| Update 7 | Yes |
| Update 6 | No |
| Update 5 | Yes |
| Update 4 | No |
| Update 3 | No |
| Update 2 | No |
| Update 1 | No |
Revision history
- 19 Dec 2025: To address scope injection vulnerability, ColdFusion has updated scope precedence to protect non-user-controlled scopes. For a complete list of reserved words in CFML, see Reserved words and reserved variable names in ColdFusion.
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Share additional feedback to help us improve.
0/255
|
