[Filing on bahalf of ###@###.###, as he does not have bugster write access]
JAXP FactoryFinder in JRE makes incorrect assumption about class loaders and throws ClassCastException in OSGi environment. See https://glassfish.dev.java.net/issues/show_bug.cgi?id=11860 for details.
JRE has javax.xml.stream.XMLInputFactory.class and a default implementation of this service class. Woodstox bundle has javax.xml.stream.XMLInputFactory.class and a default implementation. For whatever reason, woodstox does not use javax.xml.stream.XMLInputFactory.class from JRE, instead, it loads from its own bundle (Please note, boot delegation is not the default in OSGi environment).
User is using XMLInputFactory from JRE. Now, XMLInputFactory.newFactory (or an equivalent method) is called by user. For whatever reason, if it finds META-INF/service file in woodstox bundle, it will try to instantiate the woodstox provider and return it, but since woodstox uses its own StAX APIs, it results in a ClassCastException.