Hmm, after some googling I guess some of the uuid specs out there require certain characters in certain positions. CF has certainly never subscribed to that. It’s always passed strings like this

The UUID validator you linked to is expecting the format with an additional hypen

But CF calls that a GUID, not a UUID.

Looking at our code, I don’t know where this regex came from, but this isn’t correct

There is no requirement that says only certain chars (outside of any valid hex char) can go in a specific location. Why are we forcing certain chars to be [89abAB] for example? Our GUID regex is wrong as well.

The format is simply this:

GUID (36 chars)

UUID (35 chars)

and any character can be any valid hex (0-F)

We need to simplify these regular expressions to just enforce that.

In BoxLang if I run these (both the same length) one it false the other is true

Both return true on ACF and Lucee

Hmm, I am not sure but this uuid is 35 characters long, I believe the UUID spec claims it should be 36.

Also, if you validate it online here it claims it is not valid