Installing and troubleshooting Java updates in ColdFusion

With the recent ColdFusion releases, we have come across many queries regarding Java updates. The table below shows the default Java shipped with the supported versions.

 ColdFusion Version  Base Installer  Refreshed Installer
 ColdFusion 2016  1.8.0_72   NA
 ColdFusion 11  1.7.0_55   1.8 _25
 ColdFusion 10  1.6.0_29  1.7.0_15


Now, let us look at the supported Java versions for ColdFusion 2016,11 & 10.

Java Version  ColdFusion 2016  ColdFusion 11  ColdFusion 10
Java 1.8  All the updates  Update 3 and above  Update 14 and Above
Java 1.7  Not Supported  Update 2 and earlier  Update 8 and Above
Java 1.6  Not Supported  Not Supported  Update 7 and earlier


Once the support for a major version of Java is added, it also covers all the minor/sub versions.


Upgrading to Java 1.8:

  1. Download the latest version of Java from Please make sure that you download 64-bit Java for 64-bit ColdFusion and 32-bit Java for 32 bit ColdFusion.
  2. Run the installer to install Java.
  3. Take a backup of jvm.config(located at <cf_install_root>cfusionbin)
  4. To change from ColdFusion’s default Java, modify the Java home url in either jvm.config or in ColdFusion administrator (Settings ->Java and JVM -> Java virtual machine path).
  5. Restart ColdFusion after making the changes.
  6. To verify the update, log in to ColdFusion Administrator and see verify the newer Java version .

If you are using Web Services, please do the following:

  1. Take a backup of tools.jar from {cf_install_home}/cfusion/lib/
  2. Copy tools.jar from {JDK8_Home}/lib to {cf_install_home}/cfusion/lib/
  3. Clear the stubs from {cf_install_home}/cfusion/stubs/ to get the newly compiled classes.


Note: Any SSL certificates added to the previous JDK will also need to be re-added to the new JDK (cacerts) file.

You can use Java keytool tool located in Javajre1.8.0_XXbin to import the certificate.  You can use the below command:

keytool -import -alias name -keystore Javajre1.8.0_XXlibsecuritycacerts -file mycert.cer


Java upgrade issues and troubleshooting

  1. If you are unable to start ColdFusion after the Java update:
  • Check the location of Java home in jvm.config.
  • The Java auto-update modifies the Java install directory location, which causes failure to ColdFusion start. Disable the java auto upgrade.
  • Try starting ColdFusion from command line to see specific errors. If the error is "Error loading: C:Program FilesJavajdk1.X.Xjrebinserverjvm.dll", then copy the msvcr100.dll file to <cf_install_root>/cfusion/bin from {JDK8_Home}/bin (for Windows OS).
  1. After importing certificates, if you have issues related to SSL, then you need to enable debugging for SSL. Take a backup of jvm.config at ColdFusioncfusionbin and add under the “Arguments to VM” in jvm.config. This would require a CF service restart. The argument would append the debugging info to the coldfusion-out.log at ColdFusioncfusionlogs.


Understanding various types of memory and tuning in ColdFusion

Memory management is the process of recognizing, when allocated objects are no longer needed, deallocating (freeing) the memory used by such objects, and making it available for subsequent allocations. Since ColdFusion is an application server, ColdFusion requires memory management for effective performance improvement.

Sun Java differentiates memory across five generations:

  1. Young Generation: This generation holds objects with a high mortality rate. In ColdFusion, usually this space holds a variable that only exists in one page, for example – variable scope.
  2. Tenured Generation: This generation holds objects that live for a longer duration. For example, in ColdFusion, client and session scope variables.
  3. Permanent Generation: This generation holds all the reflective data of the virtual machine itself, such as class and method objects.
  4. Minor collections: This type of Garbage Collection (GC) occurs in the Young generation. In ColdFusion, minor collection collects unreferenced local scope and variable scope variables
  5. Major collection: This type of GC occurs in tenured generation. In ColdFusion, this collection collects all unreferenced session scope variables.


We can optimize the amount of memory allocated to ColdFusion server, for better performance. Let us discuss some of the parameters, which will help in Memory tuning.

  1. -Xmx – Defines maximum Java heap size.
  2. -Xms – Defines minimum Java heap size.
  3. MaxPermSize / MaxMetaspaceSize: The JDK 8 JVM uses native memory for the representation of class metadata and is called Metaspace. Users with JDK1.7 or lower will see the attribute MaxPermSize, and users with JDK 8 will see the attributes MaxMetaspaceSize.


Garbage Collection

Garbage collection refers to the process of recycling memory that was assigned to objects no longer referenced by a program. Garbage collection can be divided into 2 types:

  • Minor collection: Garbage collection that occurs in the young generation. In ColdFusion, minor collections will collect unreferenced local scope and variable scope variables
  • Major collection: Garbage collection that occurs in tenured generation. In ColdFusion, this will collect all unreferenced session scope variables.


Concurrent Collector

If the sites on your server are primarily lightweight request/response applications where response times are critical, then the concurrent garbage collector is a viable choice for your server. This collector does its best to collect dead objects from memory while applications on the server are still processing data. This adds a small bit of overhead for transactional applications, but it helps applications maintain their response-time SLAs.  To enable concurrent collector You need to add one of the following jvm arguments in jvm argument -XX:+UseConcMarkSweepGC  or -XX:+UseG1GC

For more information on concurrent collector please click here

Parallel Collector

If the applications on your server are memory-intensive and allocate a lot of objects, then the parallel garbage collector is a viable choice for your server. Any application performing image manipulation or creating a lot of objects is a great candidate for the throughput collector. To enable this garbage collector, add the following JVM arguments in the jvm.config: -XX:+UseParallelGC

 For more information on Parallel collector please click here  


Where to make the chnages?

You can make the changes at ColdFusion administrator (Settings >>Java and JVM >> JVM Arguments). 

Alternatively, you can tune memory in jvm.config, located at ColdFusion install directory (cf_root >> instance name >> bin >> jvm.config). 

Note: It’s always recommended to take a backup of jvm.config before making any changes.


Sever Monitor

If you have an Enterprise edition of ColdFusion, you can use Sever Monitor to monitor your server. You need to go to ColdFusion Administrator >> Server Monitor. To Start and Stop Monitoring, profiling, and memory tracking, click the appropriate buttons o of the server monitor.

Let us discuss about the Server Monitor in detail.

  1. Start Monitoring: This feature gathers information about all requests, including active requests, slowest requests, active sessions, cumulative server, etc. The Server Monitor does not gather information for requests that are excluded on the filter settings page.
  2. Start Profiling: It starts tag and function timing information for the slowest request reports, active queries, slowest queries, cached queries, and query cache status. You can view about each request that is slow or consumes a lot of memory. You can use this feature on development server. We do not recommend you to use this feature in a production environment.
  3. Start Memory Tracking: It gathers information about memory consumption, including all memory usage, queries and session that use most memory. You must enable profiling to view query-related reports.


You need to see if there is any effect on non-heap or heap memory at all. What needs to be deduced from the graph is, if the non-heap memory increases then, the perm gen/metaspace value needs to be recalculated. Whereas, if the heap memory increases, then the Xmx needs to changed.

You can also take help from some 3rd party software to monitor your server like GC viewer. You can also use Jconsole.  It is another memory management tool provided within JDK. The usage information is available at

Follow the same procedure, mentioned above for non-heap or heap memory monitoring and tuning.


Updates for ColdFusion 2016 and ColdFusion Builder 2016 are available now

This post is to announce the availability of updates for ColdFusion 2016 and ColdFusion Builder 2016.

ColdFusion (2016 release) Update 3

ColdFusion 2016 Update 3 includes support for Windows 10 Version 1607 and IBM Websphere Application Server 9. It also includes approximately 180 bug fixes(including ~100 external bugs) related to Language, Document Management, Serialization, Net Protocols, Database, Administrator and a few other areas.

For more details, refer this tech note.

ColdFusion Builder (2016 release) Update 3

ColdFusion Builder 2016 Update 3 includes:
    1. Important security fixes
    2. Bugs fixes in the areas of Editor and Security Code Analyzer.
    3. Upgraded PhoneGap libraries(from version 5.2.0 to version 6.0.0)
    4. Dictionary (Code Assist) changes to accommodate the changes/enhancements in ColdFusion 2016 Update 3 and earlier.
For more details, refer this tech note.

NOTE: We will be back porting all the important/applicable fixes to ColdFusion 10 and 11 version. Pre-release build for the same will be available in a couple of weeks for your feedback.

Configuring connectors with Apache Virtual Hosts in ColdFusion (2016 release)

ColdFusion (2016 release) has a webserver configuration tool for creating connectors with external web servers. These connectors work with Apache and IIS webservers. You can create one single connector (ALL) to run with all your websites or create individual connectors (ALL-Individually) for each website. We have seen scenarios, where users use “Virtual Host” to run multiple websites on a single server, in Apache.

In this blog, we will see, how to configure ColdFusion connector to work with multiple Virtual hosts in Apache and map the virtual hosts with individual instance of ColdFusion.

Note: – This blog is written, in context of Apache being installed in an RHEL environment.


Scenario 1:  Configuring connector to run with multiple Virtual hosts

Unlike IIS, we don’t have the option to select multiple websites, when we run the Web Server Configuration tool or WSCONFIG tool. To achieve this, we will have to create a connector with Apache, which will have multiple websites (Virtual hosts).  Assuming that we have already installed ColdFusion (2016 release) and Apache, we shall go ahead and create the connectors with Apache.

To create a connector in ColdFusion (2016 release) with Apache in RHEL, please follow the below:

  1. Navigate to cf_root/cfusion/runtime/bin
  2. Enter the command

sudo ./wsconfig -ws Apache  -bin /usr/sbin/httpd -script /usr/sbin/apachectl -dir /etc/httpd/conf/ -v

Note: The above command assumes pre-configured Apache in RHEL environment, command line switches and path for binaries may change across different flavors of Unix (Reference article).

Once you have created the connector successfully, ColdFusion creates a file mod_jk.conf in the location /Apache_root/conf/ (/etc/httpd/conf/ in this example).

To configure the connector and run multiple Virtual hosts, copy the JKMountFile path entry from mod_jk.conf file and add it to each of the Virtual Host blocks. For example, refer to the screenshot below:


Add the entry JkMountFile "/opt/coldfusion2016/config/wsconfig/1/" and add it to each Virtual Hosts in /etc/httpd/conf/httpd.conf, as highlighted below:


Scenario 2: Configure Apache virtual host for each ColdFusion instance

Consider the scenario where you have three virtual hosts that need to be run independently, and are not to be served by a single instance of ColdFusion.

To achieve this, you require three instances of ColdFusion server. Each server instance has separate settings. For example, let there be three instances of ColdFusion servers Instance1, Instance2, and Instance3 to be configured with three virtual hosts Website1, Website2, and Website3 respectively.

  1. Create the connector with Instance1 using the command (mentioned in Scenario 1). This step creates the connector-related files in the cf_rootconfigwsconfig1 folder.
  1. Add the server names to worker list in located in cf_rootconfigwsconfig1 folder. Add Instance1, Instance2, and Instance3 to the parameter worker.list.

  1. Add the configurations below for each instance of server in file:

For server Instance1


For server Instance2


For server Instance3



Note: Instance* is the AJP/1.3 port number associated with individual server instance that can be found in server.xml at cf_rootinstance_nameruntimeconf.



  1. Create the file for each instance of ColdFusion at the location cf_rootconfigwsconfig1. In this example, you require three copies of file (name it as –,, and

4.1 Copy the content of in cf_rootconfigwsconfig1 to,, and

4.2 Replace the instances with the corresponding servers: –

  • In, all the entries for server name will become “Instance1” (Screenshot 1),
  • will have “Instance2” as server name (Screenshot 2)
  • will have “Instance3” as server name (Screenshot 3).


Screenshot 1:


Screenshot 2:




  1. Define the URI mappings associated with each server instance in virtual host configuration to run the websites independently.

To run Website1 on server instance "Instance1", add the JKMountFile path as mentioned below in virtual host configuration (/etc/httpd/conf/httpd.conf):

JkMountFile "/opt/coldfusion2016/config/wsconfig/1/"

Notice that file contains URI mappings for Instance1.

Similarly, add the JKMountFile path for Website2 and Website3 that contain URI mappings for server instances "Instance2" and "Instance3".

Add the path in Website2:

JkMountFile "/opt/coldfusion2016/config/wsconfig/1/"

Add this path in Website3:

JkMountFile "/opt/coldfusion2016/config/wsconfig/1/"


Now, go ahead and verify your setup and website.



  • Any changes made to connector files requires an Apache restart for the changes to take effect.
  • Any changes made to httpd.conf file within Apache, requires an Apache restart for the changes to take effect.


ColdFusion 2016 Update 3 early access build is now available

ColdFusion 2016 Update 3 early access build is now available for your testing and feedback. It includes support for Windows 10.1 and IBM Websphere Application Server 9 along with approximately 180 bug fixes.

Please note that this is a test build and should not be used in a production environment.

Refer the documents given below for more details on this update:

1. What's New in this update    
2. Issues Fixed in this update
3. Installation Instructions

The build number after applying this update should be 2016.0.03.300232.

In case, you have configured local site for receiving the update notifications, then please take back up of the URL before changing it to the pre-release URL.

We will look forward to your valuable feedback and suggestions.


Adobe ColdFusion survey – 2016

This post is to announce a new survey titled the Adobe ColdFusion survey – 2016. I request you to take time to provide your valuable feedback via the survey.

The results of the survey will help us validate certain hypothesis we have to build the future versions of the product. We are already in the process of planning for the next version of ColdFusion, codenamed Aether.

Here is the survey link again. Part of the survey result will also be presented at Adobe ColdFusion Summit this year. Thank you for your time.


Breakfast with Adobe ColdFusion Team July 26-Aug 4

Please join the ColdFusion team for breakfast and hear about what's new in ColdFusion 2016 and the new API Management solution.

All events will be held at the following locations and dates, and will include breakfast.


8:00 a.m.: Breakfast

9:00 a.m.: What's New in ColdFusion 2016

10:00 a.m.: Building and Managing APIs with ColdFusion 2016



Email with the event location


Event Dates and Locations:

July 26, 2016: 

Hyatt Regency O'Hare

9300 Bryn Mawr Avenue

Rosemont, Illinois 60018


July 27, 2016:

Hyatt Regency Minneapolis (Downtown)

1300 Nicollet Mall

Minneapolis, MN 55403


July 28, 2016:

JW Marriott Downtown

806 Main Street

Houston, Tx 77002


July 29, 2016:

The Westin Austin Downtown

310 East 5th Street

Austin, Tx 78701


August 4, 2016:

Kellogg Hotel & Conference Center, Michigan State University

219 S Harrison Rd,

East Lansing, MI 48824

We hope you can make it, and look forward to seeing you at one of these locations!


Updates for ColdFusion 2016, ColdFusion Builder 2016, ColdFusion 11 and ColdFusion 10 released

This article announces the release of updates for ColdFusion 2016, ColdFusion Builder 2016, ColdFusion 11 and ColdFusion 10.

These updates address a common vulnerability mentioned in security bulletin APSB16-22.

ColdFusion 2016 Update 2

ColdFusion 2016 Update 2 fixes an important security issue. It also includes some other important fixes related to Language, Security Analyzer, AJAX, document management, SharePoint, CLI, API Manager and a few other areas.

For details, refer this technote.

ColdFusion Builder 2016 Update 2

ColdFusion Builder 2016 Update 2 (standalone) has been upgraded from Kepler to Mars. It includes important updates to Security Analyzer, a few bug fixes related to performance and other bug fixes. PhoneGap has been upgraded to 5.2.

For details, refer this technote.

ColdFusion 11 Update 9

ColdFusion 11 Update 9 fixes an important vulnerability mentioned in the security bulletin APSB16-22. It also includes a few other fixes.

For details, refer this technote.

ColdFusion 10 Update 20

ColdFusion 10 Update 20 fixes an important vulnerability mentioned in the security bulletin APSB16-22. It also includes a few other fixes

For details, refer this technote.


ColdFusion 2016 and ColdFusion Builder 2016 Update 2 are available for early access

ColdFusion 2016 and ColdFusion Builder 2016 Update 2 early access builds are now available for your testing and feedback.

Note: The early access builds mentioned here have now been released in final form. So do not use the prerelease files or info below, but rather see the later blog post:

Note that this is a test build and should not be used in a production environment.

ColdFusion 2016 Server

Change the update URL in ColdFusion Administrator -> Server Updates -> Updates -> Settings to the following:

Refer this document for issues fixed.

Here are the install instructions for Server.

The build number after applying this update for ColdFusion 2016 should be 2016.0.02.299076

ColdFusion Builder 2016

Refer this document for issues fixed.

Here are the install instructions for Builder

Standalone installation:

Change the update URL in ColdFusion Builder -> Help -> Install New Software -> Add -> Enter this URL in the location field:

For Windows/Linux –

For OS X –

Plugin installation:

Change the update URL in Elicpse 4.5.2 or above -> Help -> Install New Software -> Add -> Enter this URL in the location field:

What’s new in this Update

ColdFusion 2016 Update 2 :

  • Struct Serialization and Array Serialization :

For a struct, there isn’t a way to derive the data type info correctly and hence even today we see serialization issue where a "lastname" is being serialized as Boolean Bug #3337394.

We are providing an API on the Struct class to add metadata information to that struct object. This function will take a struct object wherein the key will be the actual key of the struct and value will be the data type of the value corresponding to that key. For example,

mystruct = StructNew() ;

mystruct.setMetadata({"lastname": "String", "age": "number"}) ;

structsetmetadata(simple,{"value":"boolean","firstname":"string", "currency": { "type": "numeric","name": "usd"}});

writedump (#mystruct.getMetadata()#); //returns: {ordered="insertion|unordered", keys={lastname="string", age="number"}}

For Array also we can set the metadata using setmetadata & getmetadata methods. Array metadata should contain the key “items” in the metadata which specifies the type of the array members.


writedump (#myArray.getMetadata()#); //returns: {"type":"synchronized", items="string"}

Application level support

Other than passing the type info at struct level, you can also define the at application level, like

this.serialization.structmetadata = {zipcode="String"};

If defined as above, you don’t need to define the data type for zipcode for all the struct which contains this key. At run-time, if the metadata of the struct is not passed at struct level but is defined at application level then we will resolve the struct value appropriately as per application metadata info. But if defined at struct, then the defined type at struct level will take priority over the application one.

  • Configure SSL– Access API Manager portals over HTTPS for better encryption and security
  • CAR settings migration– After deploying a CAR file, some settings are not migrated. You can view the list in the Archive Summary page (under the section Settings Never Migrated) while creating CAR as well as during deploying the CAR.
  • New member functions – ArrayDeleteNoCase, YesNoFormat, and BooleanFormat
  • CKEditor – FCK Editor has been deprecated. You can now customize and design text areas in a form using CK Editor in the cftextarea tag.
  • NTLM changes – The ntlmDomain attribute is required if a user is part of a domain. When the user is not part of a domain, the ntlmDomain attribute is optional.
  • Other bug fixes – API Manager, PDF, language, etc.


ColdFusion Builder 2016 Update 2

• Security Analyzer – You can view partial scan results after canceling a scan. Search for a file using the filename in Unscanned Files.

• PhoneGap – PhoneGap is upgraded to version 5.2.

• Other bug fixes – Performance, editor, Security Analyzer, etc.

We will look forward to your valuable feedback and suggestions.