Whatever message this page gives is out now! Go check it out!

JVM arguments in 2023 and 2021 updates of ColdFusion

Last update:
May 18, 2026

Application servers

On JEE installations, set the following JVM flag, "-Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**", in the respective startup file depending on the type of application server used.
For example:
  • Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file.
  • WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file.
  • WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file.
Note: The steps do not apply on a standalone ColdFusion installation.

ColdFusion (2023 release) Updates

Update 24
JVM Flags Reference
FlagDescriptionDefault
-Dcoldfusion.sql.allowUnsafeTableIdentifiersDisables identifier validation for <cfinsert>, <cfupdate>, and <cfgridupdate> table name/owner/qualifier attributes.false (validation active)
-Dcoldfusion.sql.allowUnsafeStoredProcIdentifiersDisables identifier validation for <cfstoredproc> procedure name and dbvarname bind-variable names.false (validation active)
-Dcoldfusion.xml.saxon.allowDocFunctionRe-enables the XSLT doc() / document() functions inside XmlTransform().false (functions blocked)
-Dcoldfusion.xml.saxon.allowUnparsedTextRe-enables the XSLT unparsed-text() function inside XmlTransform(), which lets a stylesheet read arbitrary text files. When left at default, calls to this function fail with a security-policy error. Enable only for fully trusted stylesheets.false (function blocked)
-Dcoldfusion.xml.saxon.allowCollectionRe-enables the XSLT collection() and uri-collection() functions inside XmlTransform(). When left at default, calls to these functions fail with a security-policy error. Enable only for fully trusted stylesheets.false (functions blocked)
Update 23
-Dcoldfusion.debugger.bindhost: Default is 127.0.0.1 (loopback-only). Controls which interface the RDS/line-debugger Jetty HTTP server binds to. Previously bound 0.0.0.0 unconditionally; now defaults to loopback. Set to 0.0.0.0 or a specific NIC IP to opt back into remote debugging.
-Dcoldfusion.xml.saxon.allowCollection: Default is False (unset = deny). Gates Saxon's collection()/uri-collection() XPath functions. Default denies file:///http:// collection URIs (new DenyCollectionFinder); set to true to restore the prior unrestricted behavior.
-Dcoldfusion.websocket.requireAuthForInvoke: Default is True. This flag controls whether a WebSocket client must be authenticated before it can invoke access="remote" CFC methods over the channel. By default, ColdFusion requires a WebSocket connection to be authenticated, either by returning true from an onWSAuthenticate handler, or through CF authentication, before it will process any CFC method invocation requested by that client. Requests from unauthenticated connections are rejected. Setting this value to false disables this requirement, allowing CFC methods to be invoked over the channel without prior authentication.
Update 22
-Dcoldfusion.sql.allowUnsafeTableIdentifiers: Default is False.
A backward compatibility flag introduced to preserve the legacy behavior of table identifier handling. By default, this flag is false, which enables the newer identifier validation logic.
When the flag is false (default):
  • ColdFusion validates table identifiers before constructing SQL statements.
  • Identifiers containing unsupported or unexpected characters are rejected during validation.
  • Invalid identifiers result in a ColdFusion validation error before the SQL is executed.
Update 21
-Dcoldfusion.attachment.allowblockedextensions: Default is False. Controls whether ColdFusion permits attachments with file extensions that are blocked by default for security reasons. When set to false (default), blocked file types cannot be attached. Setting the flag to true allows these file types to be attached, which may be required for specific trusted use cases but can increase security risk.
-Dcoldfusion.xml.saxon.allowResultDocument | Default: falseControls whether ColdFusion permits the use of xsl:result-document in XSLT stylesheets processed by XMLSearch and XMLTransform. When set to false (default), xsl:result-document is blocked, preventing stylesheets from writing output to arbitrary file paths on the server. Set to true only if your deployment explicitly requires this capability.
-Dcoldfusion.xml.saxon.allowUnparsedText | Default: falseControls whether ColdFusion permits the unparsed-text() function family in XSLT stylesheets processed by XMLSearch and XMLTransform. When set to false (default), these functions are blocked, preventing stylesheets from reading arbitrary files from the server file system. Set to true only if your deployment explicitly requires this capability.
-Dcoldfusion.xml.saxon.allowDocFunction | Default: falseControls whether ColdFusion permits the doc(), doc-available(), and document() functions in XSLT stylesheets processed by XMLSearch and XMLTransform. When set to false (default), these functions are blocked, preventing stylesheets from loading external or server-side XML documents. Set to true only if your deployment explicitly requires this capability.
-Dcoldfusion.xml.saxon.allowEnvironmentVariable | Default: falseControls whether ColdFusion permits the environment-variable() function in XSLT stylesheets processed by XMLSearch and XMLTransform. When set to false (default), this function is blocked, preventing stylesheets from reading environment variables from the host system. Set to true only if your deployment explicitly requires this capability.
Update 19
-Dcoldfusion.administrator.inputlengthfilter.maxlength: Increases the maximum size (in characters) allowed for input values processed by the ColdFusion Administrator and Admin API. By default, requests containing input fields larger than the configured limit are rejected with an input validation error. Setting this value to 65536 allows ColdFusion Administrator/API operations, such as importing or processing large SAML XML documents, to accept inputs up to 65,536 characters.
Update 17
  • -Dcoldfusion.websocket.selector.validation: Enables WebSocket selector security validation (default True). Set to false to disable deny list validation for selector expressions. It makes sure selector expressions do not have malicious ColdFusion commands in them. By default, selector expressions should use only logical operations.
  • -Dcoldfusion.deserialization.safeguard.enabled: Enables ColdFusion’s deserialization safeguard, which applies a default‑deny policy to Java deserialization: only classes required by ColdFusion and those explicitly allow‑listed in serialfilter.txt are permitted; all others are blocked and logged. Set this flag to false to temporarily revert to the previous behavior.
  • -Dcoldfusion.pdf.ddx.allowExternalEntities: Controls whether the XML parser used by the cfpdf tag with action="processddx" is allowed to resolve external XML entities defined in DDX (Document Description XML) files.
    • When false (default, recommended), ColdFusion blocks all external entity resolution when processing DDX.
    • When true:, ColdFusion allows external entities to be resolved during DDX parsing. This setting is intended only for legacy compatibility if you have existing DDX workflows that intentionally depend on external entities.
  • -Dcoldfusion.datasource.allowed.properties: By default, all connection strings are blocked. To allow a connection string in the datasource, use the flag. The values for the flag can be as follows:
    • allowLoadLocalInfile
    • allowUrlInLocalInfile
    • autoDeserialize
Update 15
  • -Dcoldfusion.xml.allowExternalEntities: This flag controls whether external entities are allowed when parsing XML. By default, the flag is set to false to disable external entity resolution, preventing potential XML External Entity (XXE) vulnerabilities such as file disclosure or denial-of-service attacks. Setting this flag to false (the default) enhances security and prevents blind XXE attacks that could otherwise be exploited to read sensitive files from the file system. If your applications rely on parsing XML with external entities enabled (not recommended), you must explicitly set the flag to true, but this may introduce security risks.
Important 
This flag is a ColdFusion server JVM argument .
  • For standalone ColdFusion, add it to the `jvm.config` file for the instance (for example, `<cf_root>/cfusion/bin/jvm.config`).
  • For JEE deployments, add it to the application server's JVM options (for example, `JAVA_OPTS` or `JAVA_OPTIONS` in the respective startup script). This flag controls whether XML external entities are allowed in XML processing within ColdFusion.
Update 14
  • -Dcoldfusion.runtime.remotemethod.matchArguments=true/false . The flag is set to true by default, which enforces strict argument matching. If a remote method expects certain parameters, those arguments must be explicitly declared using the  cfargument tag or defined directly in the function signature. For example, if a remote function is defined to accept two arguments, it must only receive those two. Passing more than the declared number (for example, 10) will result in an error. This change ensures stricter method integrity and a better debugging experience. This behavior change applies only to remote CFC methods.
  • -Dcoldfusion.systemprobe.allowexecution=true/false. By default, this flag is set to false for security reasons. The flag prevents the execution of a System Probe during a failure. To enable this functionality, set its value to true.
Update 13
  • -Dcoldfusion.cfencode.decryption.enable=true/false. The default is true. If the value is true, the files that were previously encoded with cfencode will be read.
  • -Dcoldfusion.pdfg.connectionTimeout=<milliseconds>. This is the timeout value that will be set for PDF conversion. If a conversion takes longer than the mentioned value, it will be timed out, and an exception will be thrown.
  • -Dcoldfusion.datasource.blocked.properties
    • Description: The connection strings mentioned are blocked for any datasource connection. To allow their usage in the database, remove them from the property.
  • -Dcoldfusion.compiler.block.bytecode=True. If true, the flag prevents ColdFusion from executing pre-compiled CFML code (Java bytecode) at runtime.
Update 12
After applying the update, your UUID will be reset. However, if you want to reset the ID on every ColdFusion restart for security reasons, add the jvm flag  -Dcoldfusion.monitoring.id.reset=true , and restart ColdFusion.
Update 11
ColdFusion is unable to handle sFTP connections using newer OpenSSH key algorithms like Ed25519. As a workaround, add the following JVM flags:
  • -Dcoldfusion.sftp.enable-ssh-rsa=TRUE to enable the ssh-rsa algorithm. The default value of the flag is FALSE. 
  • -Dcoldfusion.sftp.fingerprint=md5 to set md5. The default value of the flag is SHA256.
Update 8
  • The default encryption algorithm in ColdFusion changes from CFMX_COMPAT to another algorithm for seven encryption functions. 
  • Use the new JVM argument -Dcoldfusion.encryption.useCFMX_COMPATAsDefault =TRUE to make the change. By default, the value is False, if you need to use CFMX_COMPAT.
  • The flag - Dcoldfusion.encryption.useCFMX_COMPATAsDefault will be supported in future security updates for the 2023 and 2021 releases of Adobe ColdFusion.
Note: The flag is removed in ColdFusion (2025 release). View Deprecations in ColdFusion for more information.
Cfdocument access control issues
Introduced a new JVM flag -Dcfdocument.metahttpequivrefresh.localfile=TRUE.  This flag allows you to call the URL or location passed in the HTML meta tag. By default, the value is FALSE.
Any URL passed in the meta tag is, by default, blocked. If you want to use it, use the flag -Dcfdocument.metahttpequivrefresh.localfile=TRUE .
We recommend that to do a sanity check of the url before adding it to the meta tag.
Update 7
  • -Dcoldfusion.iframe.allowedprotocols: By default, ColdFusion will now block all protocols, except HTTP and HTTPS when using <iframe src=" "> in the body of cfdocument, for example, -Dcoldfusion.iframe.allowedprotocols=file,ftp
  • You can allow other protocols using the -Dcoldfusion.iframe.allowedprotocols JVM argument, Fetch values from the correct scope. Added the flag, -Dcoldfusion.searchimplicitscopes=true to the jvm arguments.
  • -Dcoldfusion.jdbc.datetime.str: instructs ColdFusion to treat datetime values as strings when passing them to the JDBC driver during SQL operations (like inserts or updates). The value is false by default.

ColdFusion (2021 release) Updates

Update 23
  • -Dcoldfusion.websocket.selector.validation: Enables WebSocket selector security validation (default True). Set to false to disable deny list validation for selector expressions. It makes sure selector expressions do not have malicious ColdFusion commands in them. By default, selector expressions should use only logical operations.
  • -Dcoldfusion.deserialization.safeguard.enabled: Enables ColdFusion’s deserialization safeguard, which applies a default‑deny policy to Java deserialization: only classes required by ColdFusion and those explicitly allow‑listed in serialfilter.txt are permitted; all others are blocked and logged. Set this flag to false to temporarily revert to the previous behavior.
  • -Dcoldfusion.pdf.ddx.allowExternalEntities: Controls whether the XML parser used by the cfpdf tag with action="processddx" is allowed to resolve external XML entities defined in DDX (Document Description XML) files.
    • When false (default, recommended), ColdFusion blocks all external entity resolution when processing DDX.
    • When true:, ColdFusion allows external entities to be resolved during DDX parsing. This setting is intended only for legacy compatibility if you have existing DDX workflows that intentionally depend on external entities.
  • -Dcoldfusion.datasource.allowed.properties: By default, all connection strings are blocked. To allow a connection string in the datasource, use the flag. The values for the flag can be as follows:
    • allowLoadLocalInfile
    • allowUrlInLocalInfile
    • autoDeserialize
Update 21
  • -Dcoldfusion.xml.allowExternalEntities: This flag controls whether external entities are allowed when parsing XML. By default, the flag is set to false to disable external entity resolution, preventing potential XML External Entity (XXE) vulnerabilities such as file disclosure or denial-of-service attacks. Setting this flag to false (the default) enhances security and prevents blind XXE attacks that could otherwise be exploited to read sensitive files from the file system. If your applications rely on parsing XML with external entities enabled (not recommended), you must explicitly set the flag to true, but this may introduce security risks.
Important 
This flag is a ColdFusion server JVM argument .
  • For standalone ColdFusion, add it to the `jvm.config` file for the instance (for example, `<cf_root>/cfusion/bin/jvm.config`).
  • For JEE deployments, add it to the application server's JVM options (for example, `JAVA_OPTS` or `JAVA_OPTIONS` in the respective startup script). This flag controls whether XML external entities are allowed in XML processing within ColdFusion.
Update 20
  • -Dcoldfusion.runtime.remotemethod.matchArguments=true/false . The flag is set to true by default, which enforces strict argument matching. If a remote method expects certain parameters, those arguments must be explicitly declared using the  cfargument tag or defined directly in the function signature. For example, if a remote function is defined to accept two arguments, it must only receive those two. Passing more than the declared number (for example, 10) will result in an error. This change ensures stricter method integrity and a better debugging experience. This behavior change applies only to remote CFC methods.
  • -Dcoldfusion.systemprobe.allowexecution=true/false. By default, this flag is set to false for security reasons. The flag prevents the execution of a System Probe during a failure. To enable this functionality, set its value to true.
Update 19
Added the following flags:
  • -Dcoldfusion.cfencode.decryption.enable=true/false. The default is true. If the value is true, the files that were previously encoded with cfencode will be read.
  • -Dcoldfusion.pdfg.connectionTimeout=<milliseconds>. This is the timeout value that will be set for PDF conversion. If a conversion takes longer than the mentioned value, it will be timed out, and an exception will be thrown.
  • -Dcoldfusion.datasource.blocked.properties
    • Description: The connection strings mentioned are blocked if a new database is added. To allow their usage in the database, remove them from the property.
  • -Dcoldfusion.compiler.block.bytecode=True. If true, the flag prevents ColdFusion from executing pre-compiled CFML code (Java bytecode) at runtime.
Update 18
After applying the update, your UUID will be reset. However, if you want to reset the ID on every ColdFusion restart for security reasons, follow the steps:
Add the jvm flag -Dcoldfusion.monitoring.id.reset=true
Update 17
ColdFusion is unable to handle sFTP connections using newer OpenSSH key algorithms like Ed25519. As a workaround, add the following JVM flags:
  • -Dcoldfusion.sftp.enable-ssh-rsa=TRUE to enable the ssh-rsa algorithm. The default value of the flag is FALSE. 
  • -Dcoldfusion.sftp.fingerprint=md5 to set md5. The default value of the flag is SHA256.
Update 14
  • The default encryption algorithm in ColdFusion changes from CFMX_COMPAT to another algorithm for seven encryption functions. 
  • Use the new JVM argument -Dcoldfusion.encryption.useCFMX_COMPATAsDefault =TRUE to make the change. By default, the value is False, if you need to use CFMX_COMPAT.
  • The flag - Dcoldfusion.encryption.useCFMX_COMPATAsDefault will be supported in future security updates for the 2023 and 2021 releases of Adobe ColdFusion.
Note: The flag is removed in ColdFusion (2025 release). View Deprecations in ColdFusion for more information.
Cfdocument access control issues
Introduced a new JVM flag -Dcfdocument.metahttpequivrefresh.localfile=TRUE.  This flag allows you to call the URL or location passed in the HTML meta tag. By default, the value is FALSE.
Any URL passed in the meta tag is, by default, blocked. If you want to use it, use the flag -Dcfdocument.metahttpequivrefresh.localfile=TRUE .
We recommend that to do a sanity check of the url before adding it to the meta tag.
Update 13
Fetch values from the correct scope
Adding the newly introduced flag, -Dcoldfusion.searchimplicitscopes=true  to the jvm arguments.
Changes to cfdocument
By default, ColdFusion will now block all protocols, except HTTP and HTTPS when using <iframe src=" "> in the body of cfdocument.
You can allow other protocols using the -Dcoldfusion.iframe.allowedprotocols  JVM argument, as shown below:
-Dcoldfusion.iframe.allowedprotocols=file,ftp
Update 6
  • cfclient is disabled by default. ColdFusion has introduced a flag if you want to enable cfclient: -Dcoldfusion.cfclient.enable=true/false
  • Enabling the flag will only allow CFCs to be read. To allow other files to be read, set -Dcoldfusion.cfclient.allowNonCfc=true/false
Update 1
  • -Dcoldfusion.datemask.useDasdayofmonth: When this flag is enabled (true), ColdFusion treats the letter d in date masks as day of month, where:
    • d = day of month (1–31)
    • D = day of year (1–365)

Share this page

Was this page helpful?
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Thank you for your feedback. Your response will help improve this page.
Previous page JVM arguments in ColdFusion (2025 release)
Next page Use multiple server instances

On this page