Toby Crawley reports:

• adding a duplicate extension under server > extensions causes an
  IllegalStateException that occurs when trying to generate the
  XMLStreamException
  (https://gist.github.com/tobias/59d155afe0c88e268b83cb75734353eb)

The problem happens because before the parser calls the invalidAttributeValue method to throw an exception, it has already consumed the element, preventing invalidAttributeValue working properly.

This should really be a custom exception that more clearly explains the problem, which is that the 'module' attribute value must be unique across the extension elements.