The ContextParameterInjector may attempt to create a proxy with a null class loader. This can happen with JDK types like java.util.concurrent.CompletatinStage. In these cases the getClassLoader() permission is required since the class loader is null. In these cases it makes sense to use the Thread.currentThread().getContextClassLoader().