What is Lucee? The CFML server compared with Adobe ColdFusion
Lucee is a free, open-source server for CFML, the language of Adobe ColdFusion. It is written in Java, runs in a servlet container such as Tomcat and is led by the Lucee Association Switzerland. This page explains what the two have in common, where they differ and when a switch makes sense.
- Every statement with its source, as of 2026-10
- ColdFusion and Lucee in production since 2015
- Reply within one working day
Published: 2026-10-26 · Editorial team Prownex
Lucee runs CFML code, the .cfm and .cfc files, just as Adobe ColdFusion does. Many applications written for Adobe ColdFusion can run on Lucee, but not every one without changes. This article covers the basics and names the source of each statement, either the Lucee project or Adobe. Which Lucee versions still receive updates is listed in Lucee: end of support at a glance.
What Lucee is and who develops it
According to its documentation, Lucee is a CFML server engine written in Java. CFML, the ColdFusion Markup Language, covers a tag-based language for templates and its scripting counterpart CFScript for the program logic. Lucee compiles a page the first time it is requested. It comes with the services web applications need: sessions, database access, ORM, mail, scheduled tasks and caching. In newer versions the project ships some of them as extensions.
Lucee is configured in the Lucee Administrator, a web application in the browser. This is where you set up data sources, caches and extensions, among other things.
The project is led by the Lucee Association Switzerland, a non-profit association under Swiss civil law whose members are companies. Lucee is free and open source; according to the project it is released under the GNU Lesser General Public License, version 2.1. It grew out of the Railo CFML Server: the documentation states that Lucee 4.5 was forked from Railo 4.2.
Lucee and Adobe ColdFusion: what is the same and what is not
Both run CFML and CFScript, both run on Java, and both are configured through an administrator in the browser. The Lucee documentation describes Lucee as highly compatible with Adobe ColdFusion and lists known differences on the same page.
| Topic | Lucee | Adobe ColdFusion |
|---|---|---|
| Developed by | The Lucee project, led by the Lucee Association Switzerland | Adobe |
| Licence | Free and open source (LGPL 2.1) | Commercial, Standard and Enterprise editions; free Developer Edition for development |
| Runtime | Java, in a servlet container such as Tomcat | Java, with an embedded server or as a web application on a JEE application server |
| Administration | Lucee Administrator | ColdFusion Administrator |
| Updates | Releases and security advisories from the Lucee project | Updates and security bulletins from Adobe, support periods per the Adobe matrix |
One difference the Lucee documentation names is how arrays are passed: Adobe ColdFusion passes them to functions as a copy, Lucee by reference. CreateTimeSpan() returns a date in Adobe ColdFusion and a timespan in Lucee. The documentation also lists Adobe tags and functions that Lucee does not support (As of 2026-10). Examples are the Exchange tags, cfreport, cfhtmltopdf, cfpdfform and the spreadsheet functions.
Moving between Adobe ColdFusion and Lucee: when it makes sense and when it does not
A move works in both directions: from Adobe ColdFusion to Lucee and from Lucee to Adobe ColdFusion. We favour neither CFML engine; the direction follows from what your application and your organisation need.
Adobe ColdFusion is the better fit when the application uses features that Lucee does not support, for example PDF forms, reports or Exchange, or when you need vendor support with fixed support periods and security bulletins. Lucee is the better fit when the application uses no such features and your team wants to work with an open-source project whose code and releases are public, and applies updates itself or through a provider.
Every move means one-off effort: reviewing the code, carrying over settings from the Administrator, testing, and switching over with a way back. We check how well your code fits the target engine in the legacy review or in the first phase of the migration, before you decide. We will also tell you if the move does not pay off and you are better off staying on your current engine in a supported version. More under Migration and modernisation and on the page ColdFusion & Lucee.
How Lucee runs: Java, servlet containers and Docker
According to the documentation, the basic requirement is a servlet engine: Lucee runs in a Java servlet container, and the project's own packages use Apache Tomcat. The project offers several ways to install it:
- Lucee Installer for Windows and Linux, with Tomcat, its own Java and connectors for Apache or IIS; according to the documentation the usual choice for production.
- Docker images based on Tomcat, also with Nginx preconfigured or as a light variant without extensions.
- Lucee Express as a ZIP archive for testing and local development.
- Lucee.jar and Lucee.war for other servlet engines.
Lucee runs on Windows, Linux and macOS; the system requirements list Debian, Ubuntu, Red Hat Enterprise Linux and Windows Server, among others. They also state which Java and Tomcat versions fit which Lucee version. How an existing application moves into a container is described in From hosting to containers.
Versions and support: where to find the current status
The Lucee project maintains a long-term support (LTS) branch alongside the current stable line. According to the project, Lucee 6.2 is the LTS branch and Lucee 7 the current stable line; Lucee 5.4 and older branches no longer receive security updates (As of 2026-10). Dates and sources are in Lucee: end of support at a glance.
The project publishes releases on its download page and in its developer forum, and security advisories in its GitHub repository. Applying them and securing the server is up to you or a service provider. The Lucee Administrator shows the version of your installation on its overview page.
For Adobe ColdFusion, Adobe lists the support periods in its end-of-life matrix. What that means for your version is explained in ColdFusion: end of support and options.
Sources for this article
The information comes from the following publications of the projects (as of 2026-10):
- Lucee documentation: home page (opens in a new window) and Getting to know Lucee Server (opens in a new window) for how Lucee is built and works.
- Lucee documentation: why Lucee (opens in a new window) and Lucee on GitHub (opens in a new window) for the licence.
- About Lucee (opens in a new window) for the Lucee Association Switzerland and Migrating from Railo (opens in a new window) for its origins.
- Migrating from Adobe ColdFusion (opens in a new window) and Unsupported tags and functions (opens in a new window) for the differences.
- System requirements (opens in a new window), Download and install (opens in a new window) and Lucee Docker images (opens in a new window) for running Lucee.
- Adobe ColdFusion: product page (opens in a new window), Licensing and activation (opens in a new window) and ColdFusion and the JEE platform (opens in a new window) for Adobe ColdFusion.
Frequently asked questions about Lucee
Do you only know Adobe ColdFusion, or Lucee as well?
Both. Our engineers have worked continuously with ColdFusion and Lucee in production systems since 2015. That covers Adobe ColdFusion from version 9 to 2025 and Lucee 5, 6 and 7. We also work with ColdSpring, custom frameworks and migrations from Adobe ColdFusion to Lucee.
Will our application run on Lucee unchanged?
That cannot be answered in general. Lucee implements CFML, but not every function behaves as it does in Adobe ColdFusion. Typical stumbling blocks are Adobe-specific tags and functions, and PDF output. Settings from the ColdFusion Administrator, such as data sources, scheduled tasks and mail sending, add to that.
Our engineers have migrated applications from Adobe ColdFusion to Lucee and build checks and tests into the plan from the start. The ColdFusion check assesses the installation; the code is checked in the legacy review or in the first phase of the migration. More on the page ColdFusion & Lucee.
What are the alternatives to Adobe ColdFusion?
There are three routes: stay with Adobe and use a supported version, migrate to Lucee, or evaluate BoxLang, another CFML-compatible runtime. Lucee is free and open source.
Which route fits depends on the number of servers or containers, on Adobe-specific features and on your support requirements. Our practical experience is with Adobe ColdFusion and Lucee. A rewrite in a different stack is rarely worth it. The page Use the monolith as a web service describes how existing logic can continue to be used.
Who provides updates and support for Lucee?
Lucee is free and open source. The Lucee project publishes new releases; applying and securing them is up to you or a service provider.
We take over this maintenance on request: updates, securing the Lucee Administrator, monitoring and backups. We settle this before the migration, so that responsibility is clear after the switch.
Is my Lucee version still secure?
That depends on the branch. According to the Lucee project, Lucee 5.4 reached its end of life on 31 December 2025 and receives no more security updates; Lucee 6.2 is the long-term support branch and Lucee 7 the current stable line, and both receive updates (As of 2026-10). The project publishes its security advisories on GitHub: the fixes for CVE-2024-55354 went into Lucee 5.4.7.3 and 6.1.1.118, and for CVE-2026-29519 the project merged a fix for the 7.1 line in October 2026.
The setup matters just as much: a Lucee Administrator that cannot be reached from the internet, a current Java runtime and regularly applied updates. In the ColdFusion check we also assess Lucee installations and tell you whether an update is due. All dates with sources are in Lucee: end of support at a glance.
Describe your situation and we will reply within one working day
A few sentences are enough to start.
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)