In (commit ) synchronized was removed from the internals of LSParseNumber.
This code internally uses java.text.NumberFormat in a manner that appears to be written with the purpose of sharing the NumberFormat object between threads.
https://docs.oracle.com/javase/8/docs/api/java/text/NumberFormat.html includes this note on synchronization: "Number formats are generally not synchronized. It is recommended to create separate format instances for each thread. If multiple threads access a format concurrently, it must be synchronized externally.".
This was previously noted by "JP" (redtopia) in comments on but it doesn't appear any issue specific to the problem was ever filed.
I have been able to reproduce this by calling LSParseNumber inside a method called on every request on my local development system (on Lucee 22.214.171.124) and then pointing apachebench at it and leaving it for a long time.
This does not happen very often.
I am not able to share the source code I've reproduced this with. If truly needed I can try to make a minimal example, but I don't think one is neccessary; Lucee is specifically doing what the Java documentation says not to do.
Exception message: 'For input string: .1565023913123E10.1565023913123E10'
Exception type: java.lang.NumberFormatException