During my routinely network scan of my server i saw that openfire suddenly started to consume 200% CPU and >2GB RAM (resident memory). I did a few more tests and it boils down to the service identification scan of nmap and 4 Ports. It’s reproducible with the command
nmap -sS -v -v -A -p 7443,7777,9090,9091
Running this will make openfire consume 200% and up to 2.8GB memory on my box. The memory usage is a little random from 1.2GB to 2.8GB in my tests. For increased damage run it multiple times, the memory usage won’t go up but each time consumes additionaly 200% CPU. I haven’t tested any limits but the cpu usage stays at the reached level even minutes later (sorry, no long time test, that fan noise is killing me).
The first thing i tried was updating the old java 1.6.27 to 1.7.0.17 but this didn’t change anything. Openfire is 3.8.1.
A friend was able to reproduce that on FreeBSD. It’s probably SSL-related, so only the SSL ports may be the problem.