We recently upgraded from CXF 3.1.9 to 3.5.5 and after upgrade encountered this bug.
Specifically we have some javax.ws.rs.container.ContainerRequestFilter implementations that are built using @Produces methods on our base javax.ws.rs.core.Application class. Since the upgrade we have discovered that these filters are being added to the request interceptor chain twice.
After debugging I found that all CDI managed beans built by @Produces methods that use the @Provider annotation for discovery are now processed twice.
It appears to me that the problem is in the current implementation of JAXRSCdiResourceExtension. This implementation has @Observes methods for both ProcessProducerMethod events and ProcessBean events - but ProcessProducerMethod extends ProcessBean so both of these handlers get called for each ProcessProducerMethod event fired by the CDI implementation. This means both handlers add the producer method to the list of providerBeans and the producer method is subsequently called twice when loadProviders() is called and two instances of the provider are passed to the JAXRSServerFactoryBean.
I believe this behaviour was introduced by this commit: