The vulnerability manifests in CLI handshake processing where thread creation isn't properly bounded. The CliProtocol.run() method is the primary entry point for CLI connections in Jenkins. While no direct patch diffs are provided, the security advisory explicitly links the vulnerability to CLI handshake handling, and thread consumption patterns typically involve unbounded execution contexts like thread-per-connection in network handlers. The confidence is high as this matches both the vulnerability description and Jenkins' architecture.