The vulnerability stems from WEBrick's failure to sanitize terminal escape sequences in Basic Authentication usernames before logging. The key functions are: 1) Log formatting in lib/webrick/log.rb which lacked escaping, and 2) Authentication handling in basicauth.rb that passed raw user input to the logger. The GitHub commit 6617c41292 shows escaping was added to Log#format and exception messages, confirming these were the vulnerable points. Red Hat's advisory explicitly mentions WEBrick log sanitization fixes.