ColdFusion 11 Update 5 and ColdFusion 10 Update 16 released

The following ColdFusion updates are now available for download:

ColdFusion 11 Update 5

This Update includes approximately 115 bug fixes related to Language, Mobile Support, File Management, Document Management, Administrator, Connector and several other areas.

It also addresses a vulnerability mentioned in the security bulletin APSB 15-07 and support for Apache 2.4.10. With this update the Web Server Config tool now backs up all the connector configurations files.

For the details refer this technote.

ColdFusion 10 Update 16

ColdFusion 10 Update 16 includes approximately 35 bug fixes related to File Management, ORM, Language, Document Management and certain other areas. It also addresses a vulnerability mentioned in the security bulletin APSB15-07.

For the details refer this technote.

92 Responses

  1. Good to see the update released in final form, guys.

    I see already one nice improvement, not mentioned above, nor in the technote or “bugs fixed” page: the web server config tool (wsconfig) now warns us that removal of a connector will remove any customized settings/tweaks one may have made to that connector’s configuration. Thanks for that.

    Also, for the information of readers here, if one does CF11 update 6, and then reconfigures the connectors (as one should), the isapi_redirect.dll will now be dated 3/11/2015.

  2. Sorry, I said “cf11 update 6” in my last comment and of course I meant the one in this blog entry, update 5.

    Also, I do see that the “bugs fixed” docs for CF11 does at least imply the change I highlighted, in the entry labelled, “WSConfig does not back up all the config files it changes.” That’s not in the CF10 “bigs fixed” guide.

    Speaking of that, I’ve not yet had a chance to confirm if the updated prompt in the wsconfig UI is only in 11 and not 10. Anyone else know or notice it yet?

  3. Getting a major issue when encrypting strings after installing this update. Gives the error

    “Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;”

    when attempting to encrypt any string using different encryption types. Tried across two applications after installing the update, rerunning web server config and restarting CF services.

  4. Clearing the contents of {cfrootdir}/wwwroot/WEB-INF/cfclasses folder should take care of this. Please make a note to also restart the server. Let us know in case you still have an issue.

  5. @haxtbh: Thanks; was just curious. Somewhere along the way, I’ve gotten in the habit of clearing the template and component caches after updating due to running into something like this on one of our production servers. I know it’s a bit of a performance hit but it has always felt safer.

  6. @Haxtbh I had a similar issue with encrypt/decrypt after updating I got an error message but here is how I fixed it. Previously my code was

    –cfset SecretHere = encrypt(TheStringHere, TheSecretKey, “AES”, “hex”)–

    I changed it to

    –cfset SecretHere = encrypt(“#TheStringHere#”, TheSecretKey, “AES”, “hex”)–

  7. After the latest update on CF 11 the following CFFORM and CFINPUT statement stopped working? Is there an issue with how CFFORM and CFINPUT work in CF 11? Any suggestions.

    -cfform action=”/search.cfm” method=”get” name=”headerSearch” id=”headerSearch”-
    -cfinput type=”text” autocomplete=”off” name=”q” id=”headerSearchTerms” maxlength=”255″ value=”#headerSearchTerms#” /-

  8. Just wanted to throw a “me too” in on the “Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;”


    Typically, we disable all caching. However, a class file got generated before I could disable the settings. Deleting the class file and restarting CF 11 u5 seems to have resolved 99% of our issues. Though, one page is still throwing the error.

    I did rebuild the connector and it still hasn’t resolved the error. Working with the vendor to address.

  9. I cannot share the code. It isn’t mine to share.

    Uninstalling update 5 did resolve the issue on the last page that wouldn’t render. All of the pages are working at this point.

  10. On the Encrypt issues.

    We pre-compile our CFM and CFC templates, our customers now have CF11 compiled binaries that don’t work with updater 5. Have the java classes for Encrypt changed so much that it’s not compatible with pre-updater 5? is there a way Adobe could rectify this?

    “Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;”

  11. We are experiencing the Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; error also.

    We clear the cache and things will work for a few days and then it’s back.

  12. We can no longer delete image files in CF11 after update 4 or 5. The following code now fails with the message “ColdFusion could not delete the file c:inetpubcns_root2test2.png for an unknown reason.” If you try to delete the file through windows explorer, you get the message “File cannot be deleted because it is in use by coldfusion.exe”. If you wait about a minute, then you can delete the file.

    This has broken every piece of image processing code.

    cfset f = “C:inetpubcns_root2test2.png”
    cfset img = ImageNew(f)
    cffile action=”delete” file=”#f#”

    Trace:$CouldNotDeleteFileException: ColdFusion could not delete the file C:inetpubcns_root2test2.png for an unknown reason.
    body: at
    body: at
    body: at
    body: at coldfusion.runtime.CfJspPage._emptyTcfTag(
    body: at cftest2ecfm1733740874.runPage(C:inetpubcns_root2cfmtest.cfm:7)
    body: at coldfusion.runtime.CfJspPage.invoke(

  13. Tom/Chris/David/Rachael,

    The signature of Encrypt method has changed with Update 5. The method is no longer static. So pre-compiled cfm pages that are using this method will result in the “”Expected static method” error.

    To rectify this behavior you need to delete those classes from the {cfrootdir}/wwwroot/WEB-INF/cfclasses directory and clear the CF cache (CF administator > Server Settings > Caching).
    In case the affected application is hosted on multiple ColdFusion server instances, ensure that you have followed the steps mentioned above for all the server instances.

    If you are using pre-compiled classes, you need to get the cfml pages compiled again.

  14. @Piyush This should probably be mentioned in the update notes, much like you mentioned the web connector needing rerunning.

    A number of people have experienced this issue and people are not expecting to have to clear out or recompile cfml after an update.

    Those who don’t subscribe to this blog may never know how to resolve this!

  15. @Dattanand – thanks for looking into it!

    @Charlie – I appreciate the suggestions, but believe me, I didn’t come and post a reproducible test case and a stack trace without trying those things first. 😉

  16. @Rachael, not sure why the Encrypt signature change issue would resurface after you’ve cleared the cache. Could it be that you are operating in a clustered environment? If so, you might want to clear the cache from all instances. Hope that helps.

  17. Hello,

    After upgrading to update 5 when using cflocation, the path is adding rather than replace.

    In our case, in checking the login screen after being made, I use cflocation, just passing the file name, because this in the same folder.

    But for some reason, rather than redirect to the page, and this is concatenated with the current page.

    ex .:
    The current page is => local / path / index.cfm
    Rather than change to => local / path / home.cfm
    This is what happens => local / path / index.cfm / local / path / home.cfm

  18. @Welton, I just tried cooking up a simple repro case for <cflocation url="”>, and it works good for me.
    Are you using one of the CGI variables to identiy the home.cfm path? Also, are the connectors reconfigured after applying HF5?

  19. I am experiencing the same issue as comment #35. cfform/cfinput no longer working after installing update5 using Internet Explorer 9 or 11 (Firefox does work but is not used in my company). The form should submit when pressing enter in the text field, it does not submit. I tried clearing template cache, deleting cfclasses, restarting, etc. Uninstalling Update5 (back to Update4) worked.

  20. Greg,
    I am unable to observe the issue with the code you’ve shared on Chrome and IE11. On submit, I am posting the content to the same page.
    Do you see this across different browsers? Do you see any errors logged in the browser debugger? Also what platform is your ColdFusion hosted on?

  21. Nothing is output in the IE console. We are running ColdFusion 11 Update 5 on Windows Server 2008. I agree, it is working in Firefox and Chrome. Our primary browser in our corporate is IE9, it wont post. I did a test with IE11, it did not work for me either.

  22. So I had to revert this hotfix because it just introduced too many errors. Pretty much all those mentioned above and it appears that numeric validation is broken.

    In an old site using cfform validation, a field that was being validated as a float now fails if a comma is there. For instance 1,000.00 fails where as 1000.00 does not and this never happened before. Another place, it is also broken at a cfargument level. A cfargument with a type of numeric fails if the value like above is passed with a comma as where before it has not.

    I honestly refuse to add it to the bug base as sometimes it feels like it is not looked into unless voted up (experience with the WebSocket issues I originally posted). I think this should suffice for the team to test and apply a fix.

  23. Hey Greg #67 After clearing the classes it worked then stopped? So I had to revert to taking out the cfform and cfinput and making it regular inputs. My other CFFOrm and CFINPUT code seems to work so some do and some do not.

  24. Well I will need to revert part my previous comment, as I just tested on cf10 and I get an error as well for passing a numeric value with a comma. So I will do my due diligence to make sure I remove commas from this legacy codebase I am working/supporting on now when passing it into a function.

  25. Im on Windows 2008 r2/ IIS 7.5 running 64 bit. I installed this update then did as I was instructed and ran the Web Configuration Connector app as Admin, removed the existing All Sites. Then Added all sites. Restarted my Server and CF pages no longer load. Also i do not see in any of my directories Jarkarta or CFIDE. Anybody have any idea what went wrong here? Its like the connector just didnt work. Any help would be greatly appreciated!

  26. Greg/Apul,
    Looks like there’s a change in the behavior with Update 5 when using IE11.
    Hitting the enter key in the input box does not submit the form, but clicking anywhere outside the input box does.
    will investigate further and get back.

  27. Stephen,
    When you create an IIS connector here’s what happens at the webserver’s end:
    – virtual mappings are created for CFIDE (points to CFIDE in CF’s internal wbroot) and jakarta (points to the folder containing the isapi_redirect DLL)
    – handler mappings are created for .cfm, .cfml, .cfc, .cfr, cfswf files.
    – An ISAPI filter is configured pointing to isapi_redirect.dll (at /config/wsconfig//).
    – default document for the site is set to index.cfm
    (If you are creating a connector with “All sites”, these attributes will be set the server level rather than a site level)

    And here’s what happens at the CF server end:
    – A folder is created at /config/wsconfig/ which contains the isapi_redirect.dll and other properties files.
    – The connector properties are stored in the file at /config/wsconfig/.
    – The steps performed by the WSconfig tool to create the connector are logged in the wsconfig.log file at /config/wsconfig/wsconfig.log
    – And finally the wsconfig tool restarts the webserver with a message prompt.

    The content of the file would look something like this:
    where, 1 just an index number. If you have multiple connectors you’ll have additional lines starting with 2.. and so on.
    2 is the ID of the website you are creating the connector with. If you are creating a connector with “All Sites” this number should be set to “0”.
    bitness64 is the “bitness” of the connector you are creating. If you check the “configure 32 bit webserver” option in the wsconfig tool UI, this will be set to “bitness32”. Ensure that this setting matches the corresponding setting of the application pool of your website.

    After creating a connector you can check if these settings/files/folders are physically present. If not delete or remove any stale files or settings and try running the tool again with administrator privileges.
    As suggested by Charlie, you should check the wsconfig.log for clues first.

  28. Thanks so much Charlie and Piyush for the helpful information. I had to revert from a previous image as I was not able to get it working before i had to bring our servers online again, i should have saved the logs. I did indeed make sure to read your article Charlie and i ran as admin. When i say i removed I mean that i launched the connector app and then selected [All Sites] which already existed and clicked Remove. Then I added it back as i assumed this is what is needed to be done to reset the connector after an update? I will give this another try this weekend and then post back with a response. If it fails again ill save the logs. I did also notice that the Handler mappings for the Server level in IIS was pointing to /config/wsconfig/1/ which was not the newest one that was created. Each time i tried to run the connector it created a new /config/wsconfig/x and the last one was /config/wsconfig/5/ None of the handler mappings for .cfm were pointing to that new one. I tried to manually change it and restart CF/Web/Server and still no go. So it was like the connector didnt seem to do anything at all. Anyways, will post back after i try this again. Wish CF was not so finicky with updates these days…

  29. Anyone else notice a decrease in caching performance (ehcache / trusted cache) with update 16 to CF 10.

    I don’t have specifics yet, but we’re looking at FusionReactor and seeing some longer loading templates than we’ve had in a while. Templates that typically never ran longer the 5/6/7 seconds are, on occasion, hitting 20-30. Odd behavior, just wondering if anyone else is seeing similar.

    We rebuilt connectors (yes, as admin) and cleared the class files as well.

    (We’re running Windows Server 2008 R2, IIS 7.5.)

  30. Thanks for the response Charlie. I could have articulated my original question more clearly. The issue that we’re seeing has to do with increased response times, which I thought may have been related to a decrease in caching performance with the update.

    The particularly slow responses (30s+) are occurring irregularly, which is to say, it’s hard to catch them in FR.

    Now that the weekend has past, I’ve got some more specifics. Prior to updating, we were seeing our average template response time (via FR daily reports) at around 40ms. Post update, that number has gone up to close to 60ms. In the grand scheme of things, not a huge difference, except that it seems the average is really being driven up by some irregular, extremely long response times.

    Some further digging showed that memory usage also spiked (from using 25% of heap preupdate, to around 75% now). We just ran the garbage collector manually and are trying to track down what is causing the increase. It seems to be climbing back up again. The perplexing aspect is that nothing has changed, except for the update to CF.

    I’ll update if we manage to find the culprit. Any suggestions are appreciated.

  31. Again, thanks Charlie. We’ve done that, but the information hasn’t been helpful. No references to .cfm templates in the stack traces. Doesn’t seem to be a specific line of code triggering the long load times (which would make sense, since the only thing that has changed was the update to 16). Considering rolling back to see if that corrects the issue.

  32. I’m having issues with output parameters on a stored procedure. I used to have dbvarname, but that stopped any output parameters from working. I removed those around update 3.

    Now I’m having issues with my 3rd output parameter in a procedure that’s working just fine under cf9.

    The other two parameters come out as local just fine. They are varchars. This doesn’t work as either a numeric or integer.

    When I try to assign arguments.customerid = local.customerid it tells me local.customerid doesn’t exist. Since it’s a number and the default of the proc is null, I’m just assuming that CF is getting a real null for the value and treating it as undefined.

  33. Matthew,
    Can you confirm if the caching settings at CF administrator> Server Settings> Caching are optimally set.
    On a production system you may specifically want the following settings enabled:
    Component cache, Trusted cache, Cache template in request, Save class files.

    Can you also confirm if it is the same cfm pages, that are taking longer to process, everytime.

  34. @Piyush Yes, caching settings are optimally set – all those settings are enabled. We are also using cfache on the pages in question.

    It is the same .cfm templates that are generating the longer processing times. 99% of the time when they run, they are fine: uncached they might run around 300-400ms, cached they’ll only take 1ms. But they pop up in Fusion Reactor with times ranging from 10,000-30,000ms on occasion, which is really troubling. We did not have this issue before updating.

    Additionally, we know it’s not the queries on the page. Their execution time is consistently low, even when the template takes a long time to load.

  35. @Charlie Sorry for taking so long to respond. Happy to provide the stacktrace. Would be thrilled to know if it points to anything that we can address. Thanks!

    “ajp-bio-8012-exec-5876” Id=28791 RUNNABLE (in native)
    java.lang.Thread.State: RUNNABLE
    at Method)
    at org.apache.coyote.ajp.AjpProcessor.output(
    at org.apache.coyote.ajp.AbstractAjpProcessor$SocketOutputBuffer.doWrite(
    at org.apache.coyote.Response.doWrite(
    at org.apache.catalina.connector.OutputBuffer.realWriteBytes(
    at org.apache.tomcat.util.buf.ByteChunk.append(
    at org.apache.catalina.connector.OutputBuffer.writeBytes(
    at org.apache.catalina.connector.OutputBuffer.write(
    at org.apache.catalina.connector.CoyoteOutputStream.write(
    at com.intergral.fusionreactor.j2ee.filter.surrogate.FusionReactorServletResponseInterposer$1.write(
    at com.intergral.fusionreactor.j2ee.trackedstream.TrackedStream2.write(
    at com.intergral.fusionreactor.j2ee.filter.softkill.SoftKillResponseStream.write(
    at coldfusion.runtime.CachedBufferedOutputStream.flushBuffer(
    at coldfusion.runtime.CachedBufferedOutputStream.flush(
    – locked coldfusion.runtime.CachedBufferedOutputStream@dc2dd82
    at sun.nio.cs.StreamEncoder.implFlush(
    at sun.nio.cs.StreamEncoder.flush(
    – locked
    – locked
    at coldfusion.runtime.NeoJspWriter.flush(
    at coldfusion.runtime.NeoPageContext.flushOutput(
    at coldfusion.filter.BrowserFilter.invoke(
    at coldfusion.filter.NoCacheFilter.invoke(
    at coldfusion.filter.GlobalsFilter.invoke(
    at coldfusion.filter.DatasourceFilter.invoke(
    at coldfusion.filter.CachingFilter.invoke(
    at coldfusion.CfmServlet.service(
    at coldfusion.bootstrap.BootstrapServlet.service(
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(
    at coldfusion.monitor.event.MonitoringServletFilter.doFilter(
    at coldfusion.bootstrap.BootstrapFilter.doFilter(
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(
    at sun.reflect.GeneratedMethodAccessor93.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(
    at java.lang.reflect.Method.invoke(
    at com.intergral.fusionreactor.j2ee.filterchain.WrappedFilterChain.doFilter(
    at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doNext(
    at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doHttpServletRequest(
    at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doFusionRequest(
    at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.handle(
    at com.intergral.fusionreactor.j2ee.filter.FusionReactorCoreFilter.doFilter(
    at sun.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(
    at java.lang.reflect.Method.invoke(
    at com.intergral.fusionreactor.j2ee.filterchain.WrappedFilterChain.doFilter(
    at sun.reflect.GeneratedMethodAccessor50.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(
    at java.lang.reflect.Method.invoke(
    at com.intergral.fusionreactor.agent.filter.FusionReactorStaticFilter.doFilter(
    at com.intergral.fusionreactor.agent.pointcuts.NewFilterChainPointCut$1.invoke(
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(
    at org.apache.catalina.core.StandardWrapperValve.invoke(
    at org.apache.catalina.core.StandardContextValve.invoke(
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(
    at org.apache.catalina.core.StandardHostValve.invoke(
    at org.apache.catalina.valves.ErrorReportValve.invoke(
    at org.apache.catalina.valves.AccessLogValve.invoke(
    at org.apache.catalina.core.StandardEngineValve.invoke(
    at org.apache.catalina.connector.CoyoteAdapter.service(
    at org.apache.coyote.ajp.AjpProcessor.process(
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(
    – locked
    at java.util.concurrent.ThreadPoolExecutor.runWorker(
    at java.util.concurrent.ThreadPoolExecutor$
    at org.apache.tomcat.util.threads.TaskThread$

  36. Updated CF 10 to Update 16. Everything was looking good until recently. We use CFIMAGE to resize and get thumbnails from images for display purposes. After the update, our thumbnails look like crap. What happened????

  37. Thank you Piyush for comment 77.

    I see that wsconfig.exe has an “upgrade” option from command line. (I have read Charlie’s excellent blog about the “upgrade” option and also the wsconfig user guide).

    Can we use this “upgrade” option with ColdFusion 11 Update 5?

    (our problem: the wsconfig GUI (remove/add) breaks all of our custom CFIDE mappings and other CFIDE settings, such as IP restrictions, etc).

    Thanks in advance,

  38. @charlie

    Thanks for the response, albeit delayed.

    That was a long time ago. I’m actually with a different company now. I don’t remember if/how we got it resolved back then. I don’t think we did though.

Leave a reply