There are a couple of problems with org.apache.xml.security.transforms.Transform.register. The first is that it doesn't use the current thread's context class loader to load the class to be registered, which causes ClassNotFound exceptions if the class can't be loaded by the system ClassLoader. The second problem is a recursive stack overflow issue. If a custom Transform implementation calls Transform.register in its constructor, then Transform.register will try to instantiate the Transform, and so forth ... I have a fix and test case ready to be putback.