Checkmarx marks API route as “Potentiel reflected XSS”

Question

The code sniffer Checkmarx detects this API route as "Reflected XSS all client".

@GetMapping("/{id}")
public @ResponseBody Language getLan