Apache CXF loads ASM using the thread context classloader. From a pure CXF point of view, that's not wrong, so we'd better set an explicit dependency to the ASM included in the container during deployments processing, to avoid ASM shipped in the user applications from being used (which is potentially troublesome in case of undeployment/deployment sequences).