A vulnerability was found in Quarkus REST Data Panache where the sort query parameter is not properly validated on non paged collection endpoints. When a resource is explicitly configured with ResourceProperties paged equals false, the code generator ListMethodImplementor fails to apply the standard SortQueryParamValidator to the generated list method. This allows the underlying database engine to process arbitrary sort fields. An attacker can exploit this to perform side channel attacks to infer sensitive information or provide complex non indexed fields to force expensive sorting operations, leading to a denial of service.