Debugging a First‑Request MD5 Performance Bottleneck in a Java Backend with Arthas

The author presents a standard problem‑replay article describing a puzzling first‑request timeout that occurred after integrating an MD5‑based data‑snapshot mechanism into a Java backend service.

The system provides two APIs: a query API that returns a data snapshot composed of local and external data, and a confirm API that submits the snapshot for validation. Because the data shown to the user may become stale, the confirm step first checks whether the snapshot has changed.

To avoid sending the entire business object to the confirm API, the developer decided to hash the key fields of the query result using MD5. The core method looks like this:

/**
 * Generate data hash
 */
private String generateSnapShotHash(AcceptListQueryWrapResultDTO wrapResultDTO) {
    StringBuilder builder = new StringBuilder();
    for (AcceptListQueryResultDTO item : wrapResultDTO.getAllList()) {
        builder.append(item.getQuotationId())
               .append(item.getOperateType())
               .append(item.getPriceTypeCN());
    }
    return MD5.create().digestHex16(builder.toString());
}

After deployment, the first call to the query API consistently timed out, while subsequent calls returned instantly. Initial guesses blamed the mock platform, the gateway, or the database, but none proved correct.

Using the Java diagnostic tool Arthas , the team traced the execution and discovered that the MD5.create() call consumed over 99% of the request time on its first invocation. The trace showed the method cn.hutool.crypto.digest.MD5:create() taking tens of seconds.

Further inspection of the MD5 implementation revealed that its static initializer loads a large set of cryptographic algorithms from the BouncyCastle library, which involves loading many classes and resources. This heavy static loading caused the first‑call latency.

Since the Hutool MD5 wrapper does not provide an option to skip this initialization, the developers replaced it with Google’s lightweight MD5 implementation, rebuilt and redeployed the service, and the first‑request delay disappeared.

The post concludes with lessons learned: evaluate third‑party libraries carefully, avoid jumping to conclusions about environment issues, and always heed QA findings.