Major Description
One example, JAXBExtensionHelper has this line:
cls.getPackage().getAnnotation(XmlSchema.class)
According to the javadocs of Class.getPackage, a classloader may return null if it has not defined a package for the class. Specifying a package is optional, so the class needs to handle getPackage() returning null.
Note that some CXF developers seem to understand this restriction, and so parts of the codebase perform the correct null check for getPackage(), but others seem unaware of it, and so do not check for null. The right solution is to go through every call to getPackage() and add a null check.
If needed (and if it'd speed up the fixing), I can supply a patch to apply to fix all occurrences of this issue.