I found that in FUSE ESB 7.1.0.fuse-044, in lib/endorsed/ folder, it use some old release jar from apache side like
./org.apache.servicemix.specs.jaxb-api-2.2-2.1.0.jar
./org.apache.servicemix.specs.jaxp-api-1.4-2.1.0.jar
./org.apache.servicemix.specs.jaxws-api-2.2-2.1.0.jar
./org.apache.servicemix.specs.saaj-api-1.3-2.1.0.jar

But not those spec jars built by perfectus script from fuse side, we should use jars like
org.apache.servicemix.specs.jaxp-api-1.4-2.0.0.fuse-71-044.jar

The apache side specs 2.1.0 is old and miss several new fixes