Quarkus 3.39

Apply the Java 25 baseline first. These rules cover Quarkus 3.39 controls.

HTTP limits and proxy trust

• Keep quarkus.http.limits.max-body-size at or below its 10 MiB default and set smaller route-specific limits before a handler buffers or parses a body.
• Bound forms with max-form-attribute-size, max-form-fields, and max-form-buffered-bytes; values of -1 disable the corresponding field-count or buffering limit.
• Bound request lines, headers, parameters, multipart headers, connections, and HTTP/2 streams; the defaults do not provide a finite connection cap or a practical initial HTTP/2 stream cap.
• Leave quarkus.http.proxy.proxy-address-forwarding=false unless a known reverse proxy strips client-supplied forwarding headers.
• When forwarding is enabled, set quarkus.http.proxy.trusted-proxies to exact IP/CIDR ranges: an absent list trusts every proxy unless certificate-based proxy trust is configured, and hostnames cause DNS lookups on requests.
• When Quarkus terminates HTTPS, close the plain HTTP listener with quarkus.http.insecure-requests=disabled so requests cannot bypass TLS.

WebSockets Next

• Secure protected WebSockets Next upgrades with @Authenticated or @RolesAllowed on the endpoint class; annotations only on callbacks leave the upgrade unprotected. Authorize each message's operation and tenant or object access separately. For browser clients, require wss and reject untrusted Origin values before upgrade, using HttpUpgradeCheck.perform() when custom checks are needed.
• Set quarkus.websockets-next.server.max-frame-size and