Quarkus REST / RESTEasy Reactive's MultipartParser accumulates MIME part-header bytes without any size or count limit. An unauthenticated remote attacker can send a single crafted multipart/form-data request with an arbitrarily large part-header section to exhaust the JVM heap and crash the application.


Additional details:
The MultipartParser state machine reads part-header bytes (header names and values within each MIME part) into ByteArrayOutputStream (currentString) with no upper bound. The existing maxEntitySize guard only counts body bytes delivered through the data() callback; header bytes bypass it entirely.
On the non-blocking parse path (VertxResteasyReactiveRequestContext.setReadListener()), there is no wire-byte cap. An attacker can send a chunked Transfer-Encoding: chunked request containing a single MIME part with a multi-gigabyte header value (e.g. X-Boom: <4GB of data>). The parser will faithfully buffer the entire value in memory before any application code runs, leading to OutOfMemoryError.
The attack requires no authentication or valid form field names and works against any endpoint that accepts multipart/form-data.