When setting up CAS 3.5.2 Server as a Maven overlay project, some libraries in WEB-INF/lib in the resulting war file are contained multiple times in different versions (thus it depends on the classloader which one is actually used).
 stax-api-1.0.1.jar, stax-api-1.0-2.jar
 javassist-3.15.0-GA.jar, javassist-3.7.ga.jar
 commons-collections-3.2.jar, commons-collections-3.2.1.jar
,  seem to come directly from the overlay war,
 e.g. if there is a Maven dependency to cas-server-integration-ehcache; via cas-server-integration-ehcache:3.5.2 -> cas-server-core:3.5.2 -> person-directory-impl:1.5.1 ->
commons-collections-3.2.1 (the overlay war contains commons-collections-3.2).
See also the posting on cas-user: https://lists.wisc.edu/read/messages?id=31493353