Using a complex @BeanParam and @Valid causes an infinite loop while generating the violation message

[admanzoni]

Describe the bug

When using a @BeanParam as input of my endpoint and applying validation @Valid, if a validation error occurs then the validation library enter into an infinite loop while generating the violation message.

Expected behavior

The violation error message is properly generated

Actual behavior

If a validation error occurs, then I'll get an infinite loop here:

at java.base/java.lang.String.valueOf(String.java:4465) 
at java.base/java.lang.StringBuilder.append(StringBuilder.java:173) 
at io.quarkus.hibernate.validator.runtime.interceptor.AbstractMethodValidationInterceptor.getMessage(AbstractMethodValidationInterceptor.java:143) 
at io.quarkus.hibernate.validator.runtime.interceptor.AbstractMethodValidationInterceptor.validateMethodInvocation(AbstractMethodValidationInterceptor.java:76) 
at io.quarkus.hibernate.validator.runtime.interceptor.MethodValidationInterceptor.validateMethodInvocation(MethodValidationInterceptor.java:17) 
at io.quarkus.hibernate.validator.runtime.interceptor.MethodValidationInterceptor_Bean.intercept(Unknown Source)

How to Reproduce?

My @BeanParam

@Data
public class CdnRequestQueryParameters {
    @QueryParam("from")
    @Pattern(regexp = "\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}", message = "Invalid 'from' date format. Use ISO-8601.")
    private String from;

    @QueryParam("to")
    @Pattern(regexp = "\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}", message = "Invalid 'to' date format. Use ISO-8601.")
    private String to;

    @QueryParam("clusterName")
    private List<@ValidK8sName String> clusterName;

    @QueryParam("host")
    private List<@ValidHostName String> host;

    @QueryParam("httpCode")
    private List<Integer> httpCode;

    @QueryParam("method")
    private List<@ValidEnum(enumValues = {"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"}) String> method;

    @QueryParam("protocol")
    private List<@ValidEnum(enumValues = {"HTTP/1.0", "HTTP/1.1", "HTTP/2", "HTTP/3"}) String> protocol;

    @QueryParam("cacheStatus")
    private List<@ValidEnum(enumValues = {"HIT", "MISS", "PASS"}) String> cacheStatus;

    @QueryParam("zone")
    private List<String> zone;

    @QueryParam("ip")
    private List<@ValidIp String> ip;

    @QueryParam("path")
    private List<String> path;

    @QueryParam("userAgent")
    private String userAgent;
}

My endpoint:

 @GET
 @Produces(MediaType.APPLICATION_JSON)
 public Response getLogs(@BeanParam @Valid CdnRequestQueryParameters parameters) {
 ....
 }

Output of uname -a or ver

Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:50 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T6030 arm64

Output of java -version

java version "21.0.3" 2024-04-16 LTS

Quarkus version or git rev

3.28.2

Build tool (ie. output of mvnw --version or gradlew --version)

/.m2/wrapper/dists/apache-maven-3.9.6/a53741d1

Additional information

No response

[quarkus-bot]

/cc @gsmet (hibernate-validator), @marko-bekhta (hibernate-validator)

[marko-bekhta]

Hey @admanzoni 👋🏻

Thanks for the report! I've tried to reproduce the problem using the bean param you've provided (even with lombok added to the mix 🙂 ), but it seems to be working, e.g.:

ViolationReport{title='Constraint Violation', status=400, violations=[Violation{field='hello.parameters.from', message='Invalid 'from' date format. Use ISO-8601.'}]}

Any chance you can create a simple Quarkus app that reproduces your issue ? Thanks!

[admanzoni]

Thanks @marko-bekhta

By setting up the reproducer, we found out the issue. It came from a custom validator, and more particularly from the way we were building the validation message. Sorry for the fuss!

[marko-bekhta]

Hey, no worries 🙂 , and I'm glad you figured out the problem! 🎉