The vulnerability stems from the Moped::BSON::ObjectId.legal? method's regex validation. The original implementation used /^[0-9a-f]{24}$/i, which does not properly anchor the entire string in Ruby (due to ^/$ matching line boundaries). The commit dd5a7c14b5d2e466f7875d079af71ad19774609b fixed this by replacing ^/$ with \A/\z. This flaw allowed inputs with trailing newlines or multi-line data to pass validation, enabling resource consumption (DoS) or BSON injection. The GitHub advisory, CVE description, and supporting technical analysis (e.g., Sakurity blog) explicitly identify this function as the root cause.