How about this:

<cfparam name="url.comma_delimited_list" type="regex" pattern="(\d+)(,\d+)*">

Adds some partial validation to the list. Not sure if this check is server side or just client side though so may want to ensure correct data types with an additional cfqueryparam just in case when using in, say a cfquery.