STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must limit the maximum number of ColdFusion Component (CFC) function requests.

DISA Rule

SV-279082r1171310_rule

Vulnerability Number

V-279082

Group Title

SRG-APP-000435-AS-000163

Rule Version

APAS-CF-000750

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Set "Maximum number of simultaneous CFC function requests" to "1".

3. Click "Submit Changes".

Check Contents

Determine whether CFC functions are being called directly over HTTP or HTTPS by any hosted application. This can be verified by interviewing the system administrator (SA); or reviewing application source code, design documentation, or ColdFusion baseline documentation.

If CFC requests are used by hosted applications, this is not a finding.

1. If CFC requests are not used by hosted applications, from the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Verify " Maximum number of simultaneous CFC function requests" is set to "1".

If CFC requests are not used by hosted applications and the "Maximum number of simultaneous CFC function requests" is not set to "1", this is a finding.

Vulnerability Number

V-279082

Documentable

False

Rule Version

APAS-CF-000750

Severity Override Guidance

Determine whether CFC functions are being called directly over HTTP or HTTPS by any hosted application. This can be verified by interviewing the system administrator (SA); or reviewing application source code, design documentation, or ColdFusion baseline documentation.

If CFC requests are used by hosted applications, this is not a finding.

1. If CFC requests are not used by hosted applications, from the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Verify " Maximum number of simultaneous CFC function requests" is set to "1".

If CFC requests are not used by hosted applications and the "Maximum number of simultaneous CFC function requests" is not set to "1", this is a finding.

Check Content Reference

M

Target Key

5724