We currently use (and install in lib/endorsed on AS6) stax:stax-api:1.0.1 while we should use the one that's also consumed by jaxb 2.2, which is javax.xml.stream:stax-api:1.0-2 . That also doesn't have an old javax.xml.XMLConstants class that would overwrite the one coming from JDK on AS6 due to endorsing, finally causing issues when trying acessing XMLConstants.FEATURE_SECURE_PROCESSING public attribute.