Impact

Extension quarkus-spring-web on the quarkus-rest (RESTEasy Reactive) stack — the current default. The classic RESTEasy stack is not affected (it delegates to the upstream SpringResourceBuilder, which honours header semantics).
Introduced in commit c677eeb (2021-10-29, PR #19819), first released in 2.5.0. The affected line is byte-identical on every branch from 3.20 through 3.38 and on main; I could not find any release in which it is fixed.
Directly verified in source at 3.37.0, 3.37.4 and 3.38.0, with live PoCs run on 3.38.0.
Novel: no CVE, GHSA, or issue describes this; unfixed everywhere.

extensions/spring-web/resteasy-reactive/deployment/…/SpringWebResteasyReactiveProcessor.java (lines ~285–299):

if (annotationName.equals(REQUEST_PARAM)) {
    jaxRsAnnotation = REST_QUERY_PARAM;      // @RequestParam   -> query    (correct)
} else if (annotationName.equals(REQUEST_HEADER)) {
    jaxRsAnnotation = REST_QUERY_PARAM;      // @RequestHeader  -> query    <== BUG (should be REST_HEADER_PARAM)
} else if (annotationName.equals(COOKIE_VALUE)) {
    jaxRsAnnotation = REST_COOKIE_PARAM;     // @CookieValue    -> cookie   (correct)
} else {
    jaxRsAnnotation = REST_MATRIX_PARAM;     // @MatrixVariable -> matrix   (correct)
}

@RequestHeader is the only mis-mapped annotation — it is given the same mapping as @RequestParam (a duplicate of the line above it, the signature of a copy-paste). The correct target, REST_HEADER_PARAM (@RestHeader → ParameterType.HEADER), already exists in RESTEasy Reactive (ResteasyReactiveDotNames.java:141), predates the buggy commit, and is used/tested elsewhere — it is not even imported into this processor.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

No known workarounds.