The org.jivesoftware.util.cache.Cache#getLock(K key) cannot be trusted when using an argument that is not a String. String values are internalized, which will result in a mutex that is unique. Integers, for example, will not (outside of -128 through 127, maybe depending on JVM). This will lead to multiple locks based on the 'same' key being acquired and used at the same time, which defeats the purpose of the lock.

I am not certain that this affects environments that are clustered (as the Hazelcast plugin will swap out the lock implementation with something that might behave better).