We have the same problem when using CFSpreadsheet 3.4.4 and CommandBox with Lucee 5.3.8.206 (only under load / after a while / randomly)
Hoping that the problem will go away after we deploy to Aws without Commandbox.

Michael Offner’s comment “a jar get loaded that in his META-INF defines a different default Factory what is causing this” seems plausible.

The only jar CommandBox puts in the class path is the runwar.jar. Other than the Lucee jars in the war itself, there is nothing else classlaoded. The runwar.jar is very simple and can be downloaded directly for inspection here:

https://s3.amazonaws.com/downloads.ortussolutions.com/cfmlprojects/runwar/4.4.6/runwar-4.4.6.jar

There are a handful of services declared in the jar, but none of them are related to DocumentBuilder.

How would we go about finding for certain where a custom factory is being set. I do know for example that the Tuckey rewrite engine uses the DocumentFactory, but it doesn’t seem to set any default factories.

Problem is the environment, most likely with commandbox environment a jar get loaded that in his META-INF defines a different default Factory what is causing this. So yes you will not see that classes appear in your scoure code for sure. I have tested all jar Lucee uses (including tomcat) for a jat that defines a different Factory, nothing. Also we do not see that issue happening outside commandbox.

If you can tell me what needs to be changed, I’m happy to do it-- but the CommandBox source code has no references to TransformerFactory nor DocumentBuilderFactory so I’m not sure CommandBox is the source of the issue.

we see the issue popping up again in a different place

again in combination with commandbox