This has existed for quite some time. If the retrieval / creation of a user fails, the entire system will grind to a halt as the lock will never be released. The CachingCredentialsProvider in bucket has synchronisation on its internal "handlesCache" for almost all operations.

https://svn.atlassian.com/privateeye/browse/private/atlassian/bucket/trunk/src/main/java/bucket/user/providers/CachingCredentialsProvider.java

This problem only affects installations using OSUser user management, which which was the default prior to Confluence 2.7. For Confluence 2.4.x and higher which are using the default user management configuration, we recommend migrating to Hibernate user management as described here:

http://confluence.atlassian.com/display/DOC/Migrating+to+new+User+Management

This migration is done automatically for users with a default configuration when upgrading to 2.7 or later.

Customers who have customised their user management with OSUser (either for LDAP support or JIRA user management) should not attempt this migration.

Diagnosis: The way to diagnose this problem is to take a thread dump when the system is slow. If the slowness is caused by this bug, you will see many threads in the BLOCKED state in the CachingCredentialsProvider class. If you do not see CachingCredentialsProvider in your thread dump, but Confluence is running slowly, please raise a support case.