Bug Report: Mojarra 4.1.16 – ELFlash NullPointerException in clustered/distributable applications (fixed in 4.1.18)/FISH-14882 #8507

Brief Summary

Please upgrade Mojarra from 4.1.16 to 4.1.18 in Payara Server and Payara Micro to resolve a serious ELFlash defect affecting clustered/distributable Jakarta Faces applications.

The issue causes intermittent NullPointerException failures related to HTTP session replication and can leave affected users unable to access the application.

The defect has already been fixed upstream and the correction is available in Mojarra 4.1.18, released on October 9, 2026.

Upstream references:

Mojarra #6024 – ELFlash NPE in distributable clustered applications
Mojarra PR #6025 – Fix #6024 and clustered flash defects
Mojarra 4.1.18 release

Relationship to Existing Payara Issue

This request is related to Payara #8372, where the Mojarra upgrade to 4.1.16 was tracked under FISH-14486.

However, Mojarra 4.1.16 was released before the upstream fix for #6024 became available.

Therefore, this issue requests separate tracking for the Mojarra 4.1.18 upgrade, rather than reopening or extending the previously tracked upgrade.

Requested Action

Please:

• Create a separate Payara tracking task for upgrading Mojarra to 4.1.18 or newer.
• Include the upgrade in the next available Payara Community and Enterprise releases, including Payara Micro.

Given the severity of this long-standing production issue and the availability of a tested upstream fix, we would greatly appreciate prioritizing this upgrade.

Thank you!

Expected Outcome

Payara includes Mojarra 4.1.18 (or newer), incorporating the upstream fixes for clustered ELFlash and HTTP session replication.

Clustered/distributable Jakarta Faces applications should continue operating normally after session replication or failover without encountering the reported ELFlash exceptions.

Current Outcome

Mojarra 4.1.16 does not include the upstream correction.

In our production Payara Micro cluster, we have experienced intermittent failures involving:

java.lang.NullPointerException:
Cannot invoke "java.util.Map.put(Object, Object)"
because "this.innerMap" is null

at com.sun.faces.context.flash.ELFlash$PreviousNextFlashInfoManager.initializeBaseCase(...)

Once the problem occurs, affected users can encounter repeated application errors on subsequent requests.

This issue has affected our production environment for approximately two years, including more than a year of investigation through Payara Enterprise support without a permanent resolution.

The root cause has now been identified and corrected upstream in Mojarra PR #6025.

Reproducer

The problem is intermittent and difficult to reproduce deterministically. It occurs in a clustered/distributable application using replicated HTTP sessions.

Our production configuration includes:

• Payara Micro with Hazelcast clustering
• Jakarta Faces / Mojarra
• enabled
• HTTP session replication across cluster nodes
• Multiple Payara Micro instances running the same application

A detailed environment description, exception stack trace, and analysis are available in Mojarra #6024.

The upstream fix in PR #6025 includes regression coverage for the clustered Flash defects.

Operating System

Rocky Linux 9

JDK Version

Zulu JRE 21.x

Payara Distribution

Payara Micro