Picketbox uses old version of jboss logging tools that is affected by LOGTOOL-52 -------------------------------------------------------------------------------- Key: SECURITY-879 URL: https://issues.jboss.org/browse/SECURITY-879 Project: PicketBox Issue Type: Bug Reporter: Stuart Douglas Assignee: Stefan Guilhen Fix For: PicketBox_4_9_0.Final The version of jboss logging tools used is affected by https://issues.jboss.org/browse/LOGTOOL-52 This means that every logging call results in a string concatenation. This is especially bad as even trace and debug logs have been changed to use typed logging (which is not generally required as they are not translated).