ModuleClassLoaderLocator$CombinedClassLoader created for every request when using default module ------------------------------------------------------------------------------------------------ Key: WFLY-12651 URL: https://issues.jboss.org/browse/WFLY-12651 Project: WildFly Issue Type: Bug Components: Security Affects Versions: 18.0.0.Final Reporter: Matt Robson Priority: Critical Fix For: 19.0.0.Beta1 During testing, we collected jmap -clstats to see what existed. What we saw was: total = 311741 alive=1, dead=311740 Of those 311750, 310687 of them are unique ModuleClassLoaderLocator$CombinedClassLoader with the same parent 0x0000000730aa98b8 0x000000074db04db0 0 0 0x0000000730aa98b8 dead org/jboss/as/security/plugins/ModuleClassLoaderLocator$CombinedClassLoader@0x00000007f0f58650 Because they're dead, this is not a leak - but it shows what a new CL is created for every single request which is a huge performance hit. The new classloading behaviour is introduced into 7.1 by https://issues.jboss.org/browse/SECURITY-930 / https://issues.jboss.org/browse/JBEAP-6559 From https://github.com/jbossas/jboss-eap7/pull/925/files#diff-a8665415b9dad30... } else { mappingInfo.addJBossModuleName(DEFAULT_MODULE); } } The call(s) to ClassLoaderLocatorFactory.get() check for !jbossModuleNames.isEmpty() but because we now explicitly set the default module, it's never not empty so it gets called on every request. ClassLoader moduleCL = null; List<String> jbossModuleNames = jai.getJBossModuleNames(); if (!jbossModuleNames.isEmpty()) { ClassLoaderLocator locator = ClassLoaderLocatorFactory.get(); if (locator != null) moduleCL = locator.get(jbossModuleNames); }