The flex-external-processor component receives policy update events via gRPC in a continuous loop. When the WSDLValidation policy
attempts to load a WSDL file whose filename contains URL-encoded characters (e.g., %20 representing a trailing space), the Java schema
loader fails to resolve the file path. The error logged is:
Unable to load resource file:///tmp/unzip.../filename.wsdl null
Because the failure is treated as transient, the policy is retried repeatedly on each configuration delivery cycle. Each retry extracts
the WSDL zip bundle to a new /tmp/unzip* directory without cleaning up the previous extraction. This results in:
- Progressive accumulation of /tmp/unzip* directories
- Unbounded memory growth from temp files and schema parser objects not being released
- Eventually OOM-kill of the flex-external-processor pod
Versions affected: 1.13.1, 1.13.2, 1.13.3
The issue does NOT affect WSDL files with clean filenames (no spaces or URL-encoded characters). Inbound flow (Inbound messages from
citizens) works correctly. Only outbound messages that trigger the WSDL validation are affected.
Short-term workaround (customer-applied):
- Remove URL-encoded characters and trailing spaces from all WSDL filenames used by the WSDL Validation policy. Use decoded, canonical
paths.
- If external hosting is required, ensure encodings are normalized before reaching the gateway.
- Operational mitigation: set resource limits on the flex-external-processor pod, add liveness/readiness probes, and optionally add a
CronJob to periodically clean /tmp/unzip* directories.
Long-term fix:
Engineering bug W-23442789 has been filed. The fix will include:
- URL normalization and proper decoding before resolution
- Bounded retry strategy with exponential backoff
- Cycle detection and size caps to prevent unbounded memory growth
- GUS Investigation: W-23379341 (Closed - New Bug Logged)
- GUS Bug: W-23442789 (Status: New)
- MuleSoft Docs — SOAP Schema Validation Policy: https://docs.mulesoft.com/gateway/latest/policies-included-soap-schema-validation
005389192

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.