This issue was discovered by Michal Vavřík (Red Hat).

Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service

Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.