Application servers

• Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file.
• WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file.
• WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file.

ColdFusion (2023 release) Updates

• -Dcoldfusion.websocket.selector.validation: Enables WebSocket selector security validation (default True). Set to false to disable deny list validation for selector expressions. It makes sure selector expressions do not have malicious ColdFusion commands in them. By default, selector expressions should use only logical operations.
• -Dcoldfusion.deserialization.safeguard.enabled: Enables ColdFusion’s deserialization safeguard, which applies a default‑deny policy to Java deserialization: only classes required by ColdFusion and those explicitly allow‑listed in serialfilter.txt are permitted; all others are blocked and logged. Set this flag to false to temporarily revert to the previous behavior.
• -Dcoldfusion.pdf.ddx.allowExternalEntities: Controls whether the XML parser used by the cfpdf tag with action="processddx" is allowed to resolve external XML entities defined in DDX (Document Description XML) files.
  • When false (default, recommended), ColdFusion blocks all external entity resolution when processing DDX.
  • When true:, ColdFusion allows external entities to be resolved during DDX parsing. This setting is intended only for legacy compatibility if you have existing DDX workflows that intentionally depend on external entities.
• -Dcoldfusion.datasource.allowed.properties: By default, all connection strings are blocked. To allow a connection string in the datasource, use the flag. The values for the flag can be as follows:
  • allowLoadLocalInfile
  • allowUrlInLocalInfile
  • autoDeserialize

• -Dcoldfusion.xml.allowExternalEntities: This flag controls whether external entities are allowed when parsing XML. By default, the flag is set to false to disable external entity resolution, preventing potential XML External Entity (XXE) vulnerabilities such as file disclosure or denial-of-service attacks. Setting this flag to false (the default) enhances security and prevents blind XXE attacks that could otherwise be exploited to read sensitive files from the file system. If your applications rely on parsing XML with external entities enabled (not recommended), you must explicitly set the flag to true, but this may introduce security risks.

• For standalone ColdFusion, add it to the `jvm.config` file for the instance (for example, `<cf_root>/cfusion/bin/jvm.config`).
• For JEE deployments, add it to the application server's JVM options (for example, `JAVA_OPTS` or `JAVA_OPTIONS` in the respective startup script). This flag controls whether XML external entities are allowed in XML processing within ColdFusion.

• -Dcoldfusion.runtime.remotemethod.matchArguments=true/false . The flag is set to true by default, which enforces strict argument matching. If a remote method expects certain parameters, those arguments must be explicitly declared using the  cfargument tag or defined directly in the function signature. For example, if a remote function is defined to accept two arguments, it must only receive those two. Passing more than the declared number (for example, 10) will result in an error. This change ensures stricter method integrity and a better debugging experience. This behavior change applies only to remote CFC methods.
• -Dcoldfusion.systemprobe.allowexecution=true/false. By default, this flag is set to false for security reasons. The flag prevents the execution of a System Probe during a failure. To enable this functionality, set its value to true.

• -Dcoldfusion.cfencode.decryption.enable=true/false. The default is true. If the value is true, the files that were previously encoded with cfencode will be read.
• -Dcoldfusion.pdfg.connectionTimeout=<milliseconds>. This is the timeout value that will be set for PDF conversion. If a conversion takes longer than the mentioned value, it will be timed out, and an exception will be thrown.
• -Dcoldfusion.datasource.blocked.properties
  • Description: The connection strings mentioned are blocked for any datasource connection. To allow their usage in the database, remove them from the property.
• -Dcoldfusion.compiler.block.bytecode=True. If true, the flag prevents ColdFusion from executing pre-compiled CFML code (Java bytecode) at runtime.

• -Dcoldfusion.sftp.enable-ssh-rsa=TRUE to enable the ssh-rsa algorithm. The default value of the flag is FALSE. 
• -Dcoldfusion.sftp.fingerprint=md5 to set md5. The default value of the flag is SHA256.

• The default encryption algorithm in ColdFusion changes from CFMX_COMPAT to another algorithm for seven encryption functions. 
• Use the new JVM argument -Dcoldfusion.encryption.useCFMX_COMPATAsDefault =TRUE to make the change. By default, the value is False, if you need to use CFMX_COMPAT.
• The flag - Dcoldfusion.encryption.useCFMX_COMPATAsDefault will be supported in future security updates for the 2023 and 2021 releases of Adobe ColdFusion.

• -Dcoldfusion.iframe.allowedprotocols: By default, ColdFusion will now block all protocols, except HTTP and HTTPS when using <iframe src=" "> in the body of cfdocument, for example, -Dcoldfusion.iframe.allowedprotocols=file,ftp
• You can allow other protocols using the -Dcoldfusion.iframe.allowedprotocols JVM argument, Fetch values from the correct scope. Added the flag, -Dcoldfusion.searchimplicitscopes=true to the jvm arguments.
• -Dcoldfusion.jdbc.datetime.str: instructs ColdFusion to treat datetime values as strings when passing them to the JDBC driver during SQL operations (like inserts or updates). The value is false by default.

ColdFusion (2021 release) Updates

• -Dcoldfusion.websocket.selector.validation: Enables WebSocket selector security validation (default True). Set to false to disable deny list validation for selector expressions. It makes sure selector expressions do not have malicious ColdFusion commands in them. By default, selector expressions should use only logical operations.
• -Dcoldfusion.deserialization.safeguard.enabled: Enables ColdFusion’s deserialization safeguard, which applies a default‑deny policy to Java deserialization: only classes required by ColdFusion and those explicitly allow‑listed in serialfilter.txt are permitted; all others are blocked and logged. Set this flag to false to temporarily revert to the previous behavior.
• -Dcoldfusion.pdf.ddx.allowExternalEntities: Controls whether the XML parser used by the cfpdf tag with action="processddx" is allowed to resolve external XML entities defined in DDX (Document Description XML) files.
  • When false (default, recommended), ColdFusion blocks all external entity resolution when processing DDX.
  • When true:, ColdFusion allows external entities to be resolved during DDX parsing. This setting is intended only for legacy compatibility if you have existing DDX workflows that intentionally depend on external entities.
• -Dcoldfusion.datasource.allowed.properties: By default, all connection strings are blocked. To allow a connection string in the datasource, use the flag. The values for the flag can be as follows:
  • allowLoadLocalInfile
  • allowUrlInLocalInfile
  • autoDeserialize

• -Dcoldfusion.xml.allowExternalEntities: This flag controls whether external entities are allowed when parsing XML. By default, the flag is set to false to disable external entity resolution, preventing potential XML External Entity (XXE) vulnerabilities such as file disclosure or denial-of-service attacks. Setting this flag to false (the default) enhances security and prevents blind XXE attacks that could otherwise be exploited to read sensitive files from the file system. If your applications rely on parsing XML with external entities enabled (not recommended), you must explicitly set the flag to true, but this may introduce security risks.

• For standalone ColdFusion, add it to the `jvm.config` file for the instance (for example, `<cf_root>/cfusion/bin/jvm.config`).
• For JEE deployments, add it to the application server's JVM options (for example, `JAVA_OPTS` or `JAVA_OPTIONS` in the respective startup script). This flag controls whether XML external entities are allowed in XML processing within ColdFusion.

• -Dcoldfusion.runtime.remotemethod.matchArguments=true/false . The flag is set to true by default, which enforces strict argument matching. If a remote method expects certain parameters, those arguments must be explicitly declared using the  cfargument tag or defined directly in the function signature. For example, if a remote function is defined to accept two arguments, it must only receive those two. Passing more than the declared number (for example, 10) will result in an error. This change ensures stricter method integrity and a better debugging experience. This behavior change applies only to remote CFC methods.
• -Dcoldfusion.systemprobe.allowexecution=true/false. By default, this flag is set to false for security reasons. The flag prevents the execution of a System Probe during a failure. To enable this functionality, set its value to true.

• -Dcoldfusion.cfencode.decryption.enable=true/false. The default is true. If the value is true, the files that were previously encoded with cfencode will be read.
• -Dcoldfusion.pdfg.connectionTimeout=<milliseconds>. This is the timeout value that will be set for PDF conversion. If a conversion takes longer than the mentioned value, it will be timed out, and an exception will be thrown.
• -Dcoldfusion.datasource.blocked.properties
  • Description: The connection strings mentioned are blocked if a new database is added. To allow their usage in the database, remove them from the property.
• -Dcoldfusion.compiler.block.bytecode=True. If true, the flag prevents ColdFusion from executing pre-compiled CFML code (Java bytecode) at runtime.

• -Dcoldfusion.sftp.enable-ssh-rsa=TRUE to enable the ssh-rsa algorithm. The default value of the flag is FALSE. 
• -Dcoldfusion.sftp.fingerprint=md5 to set md5. The default value of the flag is SHA256.

• The default encryption algorithm in ColdFusion changes from CFMX_COMPAT to another algorithm for seven encryption functions. 
• Use the new JVM argument -Dcoldfusion.encryption.useCFMX_COMPATAsDefault =TRUE to make the change. By default, the value is False, if you need to use CFMX_COMPAT.
• The flag - Dcoldfusion.encryption.useCFMX_COMPATAsDefault will be supported in future security updates for the 2023 and 2021 releases of Adobe ColdFusion.

• cfclient is disabled by default. ColdFusion has introduced a flag if you want to enable cfclient: -Dcoldfusion.cfclient.enable=true/false
• Enabling the flag will only allow CFCs to be read. To allow other files to be read, set -Dcoldfusion.cfclient.allowNonCfc=true/false

• -Dcoldfusion.datemask.useDasdayofmonth: When this flag is enabled (true), ColdFusion treats the letter d in date masks as day of month, where:
  • d = day of month (1–31)
  • D = day of year (1–365)