XopWithMultipartRelatedJAXBProvider.java contains the following code:

protected InputPart getInputPart(String cid)

{ cid = cid.trim(); int cidIndex = cid.indexOf("cid:"); if (cidIndex == 0) cid = cid.substring(4).trim(); InputPart inputPart = xopPackage.getRelatedMap() .get(cid); if (inputPart == null) throw new IllegalArgumentException( "No attachment with cid = " + cid + " found in xop message."); return inputPart; }

i.e. it trims the 'cid:' part of the URL (if present), but it doesn't then URL decode the cid, nor does it surround the URL with angle brackets. RFC2392 states:

A "cid" URL is converted to the corresponding Content-ID message
header [MIME] by removing the "cid:" prefix, converting the % encoded
character to their equivalent US-ASCII characters, and enclosing the
remaining parts with an angle bracket pair, "<" and ">". For
example, "cid:foo4%25foo1@bar.net" corresponds to

Content-ID: <foo4%25foo1@bar.net>(sic).

It might be possible that the cid's in 'relatedMap' have the angle brackets removed and are URL encoded when the Content-ID is parsed. But this does not appear to be the case.