javax.security.auth.login.Configuration#contextClassLoader grabs a random class loader and holds onto it forever ---------------------------------------------------------------------------------------------------------------- Key: AS7-6785 URL: https://issues.jboss.org/browse/AS7-6785 Project: Application Server 7 Issue Type: Bug Components: Security Affects Versions: EAP 6.1.0.Alpha (7.2.0.Final) Reporter: Stuart Douglas Assignee: Stefan Guilhen This class uses the TCCL that is present at class initialization. This could be any class loader, and is often a deployments class loader, which causes a permgen leak.