CXF JAX-RS keeps references to thread local proxies which have been injected into class resources or providers in a weak hash map, with the map itself set as a property on a bus.
Previously there were kept in a plain hash map but in containers like TomEE this was resulting in a the wars being not released due to the default/shared bus still being around, while keeping the strong references.
Having a weak hash map apparently has some difficult to reproduce side-effects on the client side where some refreshes are happening.
The short term solution is to protect against possible NPE in thread local proxy implementations which represent contexts that might be used on the client side. This is Providers (used by CXF providers and Jackson) and CXF MessageContext.
A more effective solution would need to be done on the new trunk due to the high sensitivity of the possible refactoring of the way thread local proxies are implemented, etc...