The vulnerability stems from improper regex anchoring in bitstring validation within the quote method. The patch changes regex delimiters from ^/$ (which match line start/end) to \A/\Z (which match string start/end), indicating the vulnerable code path was in the bitstring handling branch of the quote method. This function would appear in stack traces when processing user input for PostgreSQL bitstring columns, making it the primary runtime indicator.