I raised bug 3119991 (coldfusion.util.key leaks) against CF9.01 and CF10.
The bug is marked as "Fixed in build 281656". We have upgraded our production servers to 9.02 and it appears that the bug has returned.
I decompiled the cFusion.Jar's for 9.02 and it's using HardReferences for the key cache. The fix for 3119991 used SoftReferences so I suspect the fix never made it to 9.02.
The problem is that we can't apply the hotfix (hf901-3119991.jar) to 9.02. When we try, it does not appear in the applied hotfixes area of CFAdmin. When we copy the .jar to the /lib/updates folder & cycle the CF service the OS never takes a lock on the .jar file and we still have that exact same memory leak - which makes me think it isn't being picked up.
What can we do to get the HotFix working with 9.02?
Recommend raising a new bug and tweeting it @ @rakshithn. They're doing a new patch for CF9 @ the mo' (although as it's due out tomorrow at the latest, you mighta missed the window). Tweet the bug ref at me (@daccf) and I'll chase it (my chasing seldom yields results, but it gives me something to do ;-)
New bug number is 3507060. I have tweeted @rakshithn & @daccf