STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must limit the maximum number of threads available for CFTHREAD.

DISA Rule

SV-279080r1171402_rule

Vulnerability Number

V-279080

Group Title

SRG-APP-000435-AS-000163

Rule Version

APAS-CF-000740

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure CFTHREAD settings.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Set Maximum number of threads available for CFTHREAD to "1" to disable unnecessary threading.

3. Click "Submit Changes".

Check Contents

Verify that CFTHREAD settings are appropriately configured when threading is not used by hosted applications.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Confirm with the administrator whether any hosted applications are using CFTHREAD for multithreading.

If CFTHREAD is in use, this is not a finding.

3. If CFTHREAD is not used, verify that "Maximum number of threads available for CFTHREAD" is set to "1" to effectively disable threading.

If CFTHREAD is not used, and the "Maximum number of threads available for CFTHREAD" is set to a value other than "1", this is a finding.

Vulnerability Number

V-279080

Documentable

False

Rule Version

APAS-CF-000740

Severity Override Guidance

Verify that CFTHREAD settings are appropriately configured when threading is not used by hosted applications.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Confirm with the administrator whether any hosted applications are using CFTHREAD for multithreading.

If CFTHREAD is in use, this is not a finding.

3. If CFTHREAD is not used, verify that "Maximum number of threads available for CFTHREAD" is set to "1" to effectively disable threading.

If CFTHREAD is not used, and the "Maximum number of threads available for CFTHREAD" is set to a value other than "1", this is a finding.

Check Content Reference

M

Target Key

5724