The vulnerability stems from two key points: (1) the base36_to_int function lacked input validation, allowing resource-heavy conversions of large inputs, and (2) the URL route pattern permitted excessively long uidb36 parameters. The commit diff shows both the regex tightening in urls.py and the length check added to base36_to_int in http.py, directly addressing the root causes. The CVE description explicitly ties the DoS vector to unvalidated base36 timestamp handling, confirming these functions' roles.