seemes to me there is a memory leak with the CXFAuthenticator. There is a static reference to it in java.net.Authenticator.theAuthenticator .
This prevents the GC from collecting the WebappClassLoader on hot undeployment.
I helped myself by doing
Our web application uses CXF as a jasWS client configured with Spring 3.0.5.