Please follow the instructions below to download the hotfix:

1. Log in to the TIBCO Support Portal at (https://support.tibco.com) using your credentials.

2. Once logged in, navigate to "Downloads" -> "Hotfixes," then go to /AvailableDownloads/BusinessEvents/EnterpriseEdition/6.4.0/hotfix-01 to download the hotfix.

Alternatively, you can use the direct portal link to download Hotfix-01.

BE 6.4.0 HF01 Direct Download Link

download BE 6.4.0 HF1

================================================================================

Closed Issues in 6.4.0_HF-001 (This Release)

BE-35557
When ConcurrentRTC is disabled and ObjectManagement is set to InMemory in TIBCO 
BusinessEvents 6.4.0, input and output events persist in the Java heap. 
This leads to OutOfMemory error due to accumulation of event objects in the 
Java heap.

BE-35474
During data migration, SQL Server encounters an issue when id$=0 values are 
present in a referenced legacy table. The issue leads to orphan invalid values 
not being deleted during post-migration cleanup.
The issue is fixed now and the system no longer migrates invalid parent$_id$, 
pid$, and id$ values.

BE-35457
The InferenceAgent fails to deserialize Ignite entities into BusinessEvents (BE) 
entities. This issue occurs when a DateTime property within the Ignite entity is null.

BE-35373
Apache Tomcat is upgraded to version 9.0.118 to address the below CVEs:

CVE-2026-43515
CVE-2026-43514
CVE-2026-43513
CVE-2026-43512
CVE-2026-42498
CVE-2026-41284

BE-35370
A NullPointerException occurs when the InferenceAgent processes input events 
when the Telemetry OLTP collector is enabled. This exception originates within
the MetricRecorder.recordEventThroughput() method. The FraudDetection Telemetry 
sample does not reproduce this error with the same settings.

BE-35359
In TIBCO BusinessEvents 6.4.0, the following vulnerabilities are identified in Java 25.0.1:

CVE-2025-43368
CVE-2025-7425
CVE-2026-21945
CVE-2026-21932
CVE-2026-21933
CVE-2025-6021
CVE-2026-21925
CVE-2025-6052
CVE-2026-21947
CVE-2025-47219
CVE-2025-43272
CVE-2025-43342
CVE-2025-43356
CVE-2025-47183
CVE-2025-10911
CVE-2025-7424
CVE-2025-8732
CVE-2026-20652
CVE-2026-22016
CVE-2026-34282
CVE-2026-22003
CVE-2026-22021
CVE-2026-22013
CVE-2026-23865
CVE-2026-22008
CVE-2026-22018
CVE-2026-22007
CVE-2026-34268

BE-35269
When you set a JMS delivery delay for a JMS input destination using the 
be.engine.channel./Channels/JMSChannel/Test.deliverydelay property, the 
delivery delay does not work as expected. This occurs if you also configure
a JMS session pool with the be.channel.jms.sender.session.pool.maxsize property. 
The delivery delay functions correctly only when you remove 
the be.channel.jms.sender.session.pool.maxsize property.
The delivery delay functionality now operates correctly with pooled sessions. 
This fix ensures that JMS messages are delivered with the specified delay, 
even when the be.channel.jms.sender.session.pool.maxsize property configures 
a JMS session pool.

BE-35262
The be-teagent failed to start when enabling debug logging with outdated 
configurations in the log4j2.properties file. The problem occurred because 
the properties are not updated to the log4j2.x version.
To resolve this issue, the log properties in the log4j2.properties file are 
updated with the correct logger configurations.

BE-35205
Apache Tomcat is upgraded to version 9.0.115 to address the below CVEs:

CVE-2025-66614
CVE-2026-24734
CVE-2026-24733

BE-35203
In 6.3.2 HF1 and 6.4.0, Business Process Management (BPM) agent fails to 
process SOAP response events due to missing v4 namespace declaration in SOAP 
responses, leading to validation errors. Additionally, the CDD property 
com.tibco.datamodel.xml=true must be configured. Otherwise, BE throws
an error when attempting to load the input event.

BE-35140
When an external grid is migrated from ActiveSpaces 2.x to 4.x, there 
are performance issues related to the BusinessEvents Store catalog functions. 
Internal ActiveSpaces exceptions occur due to mapping non-existent table columns.
This issue is resolved by adding a column check before performing put or get 
operations on data. 

BE-35110
When you enable OpenTelemetry (oTel) metrics with a custom FTL serializer, 
the FTL message's data field becomes corrupted.

BE-35089
You can now customize the Apache Ignite cluster working directory by using a new 
system property, be.ignite.cluster.work.dir.path. The property allows specifying a 
custom path, overriding the default java.io.tmpdir for non-shared nothing persistence
or USER_HOME\AppData\Local\Temp\ignite\work directory for shared nothing persistence.

BE-35088
When you use legacy keybase lookup with Oracle backing stores, following data 
migration issues occurred:
Migration scripts generate incorrect table names and lack necessary pid$ indexes 
for reference and array tables.
Migration fails when the be.backingstore.useobjecttable property is false, 
preventing the loading of child and referenced concepts.
Duplicate extid entries and orphan rows persist after migration, causing data inconsistencies.
SQL Server migration scripts encounter data type conversion errors and primary key 
constraint violations on nullable columns.
Inconsistent COMMIT statements and WHERE clauses lead to unreliable migration outcomes.

Following solutions are provided:
Updated migration scripts now correctly generate table names and include 
missing pid$ indexes on all relevant tables.
The scripts function correctly when be.backingstore.useobjecttable is disabled, 
ensuring proper loading of child and referenced concepts.
COMMIT statements are added after each table creation to improve transaction management.
New scripts, _migration_select_duplicatesToDeleteBeforeMigrate.sql and _
migration_delete_duplicatesBeforeMigrate.sql, identify and remove 
duplicate extid entries before you initiate the main migration.
Corrected SQL statements efficiently remove orphan rows from referenced tables.
The SQL Server migration script now handles data type conversions and allows 
primary key creation on extid$ columns by setting them as NOT NULL.
A _migration_rollback_to_legacy.sql script enables safe data rollback from key
lookup to legacy lookup.
Corrected WHERE clauses in _delete_orphanRowsAfterMigrate.sql for SQL Server 
prevent unintended data loss.

Note:
Before executing the main migration script, you must run the provided duplicate
detection and deletion scripts: _migration_select_duplicatesToDeleteBeforeMigrate.sql 
and _migration_delete_duplicatesBeforeMigrate.sql.
Ensure the be.backingstore.useobjecttable property is consistently configured 
(either true or false) across your legacy and target environments.
If you encounter migration issues, use the _migration_rollback_to_legacy.sql 
script to revert your database to its prior state.

BE-35083
The migration script, "<name>_migration.sql" contains incorrect table names due to 
inconsistent and duplicated entries in the alias file. Additionally, the pid$ index 
is missing from all reference tables (arrays). 
The issue is resolved by correcting the table names in the migration scripts and
ensuring the *.alias file contains accurate and consistent table mappings.
The necessary pid$ indexes are now included in all reference tables.

BE-35069
When you use Event.Ext.routeToImmediate() to publish Kafka Events, and the "Sync Sender" 
flag is enabled, the exceptions java.util.ConcurrentModificationException and 
java.lang.NullPointerException occurs due to the load.

================================================================================

All Supported Platforms

Please contact the TIBCO Support team if you have any trouble downloading the hotfix or if you have additional questions on this release.

TIBCO BusinessEvents Enterprise Edition 6.4.0 Hotfix-01 is available

readme file