The vulnerability root cause was identified in the SegmentedIterable class handling large object transfers. Multiple sources (bug reports, commit diffs, and OSSA advisory) show the fix involved adding explicit closure of app_iter generators in SegmentedIterable.close() to resolve cyclic references. This matches the CVE description of connection resource leaks during interrupted requests to large objects.