During testing, we collected jmap -clstats to see what existed.

What we saw was:
total = 311741
alive=1, dead=311740

Of those 311750, 310687 of them are unique ModuleClassLoaderLocator$CombinedClassLoader with the same parent 0x0000000730aa98b8

0x000000074db04db0 0 0 0x0000000730aa98b8 dead org/jboss/as/security/plugins/ModuleClassLoaderLocator$CombinedClassLoader@0x00000007f0f58650

Because they're dead, this is not a leak - but it shows what a new CL is created for every single request which is a huge performance hit.

The new classloading behaviour is introduced into 7.1 by https://issues.jboss.org/browse/SECURITY-930 / https://issues.jboss.org/browse/JBEAP-6559

From https://github.com/jbossas/jboss-eap7/pull/925/files#diff-a8665415b9dad304db6f5383c52841dfR218

} else

}

The call(s) to ClassLoaderLocatorFactory.get() check for !jbossModuleNames.isEmpty() but because we now explicitly set the default module, it's never not empty so it gets called on every request.

ClassLoader moduleCL = null;
List<String> jbossModuleNames = jai.getJBossModuleNames();
if (!jbossModuleNames.isEmpty())
{
ClassLoaderLocator locator = ClassLoaderLocatorFactory.get();
if (locator != null)
moduleCL = locator.get(jbossModuleNames);
}