The cxf-http feature load the servlet API 3.0 while pax web load servlet API 3.1. So if cxf-http is loaded before the http feature it might bind to the lower API version. If a user bundle then uses CXF and the Servlet API there can be a uses contraint violation.
I had this with the xkms features at least once. Most times the problem did not appear though.
I propose to solve this by adding a cxf-http-client feature which only installs the servlet API 3.0 and switch the default cxf-http feature to depend on http again. So users still can select to use the slim version but the default case will not be prone to the uses constraint violation.