The vulnerability stems from missing quota checks when processing allowed address pairs. The patches add validation in _validate_allowed_address_pairs and its callers. These functions would appear in profilers when handling malicious API requests creating numerous address pairs. The database mixin function is included as it's the entry point that would show up in stack traces during mass rule creation attempts.