The vulnerability stems from the header parsing logic in createHeaderGetter, which originally used a regex split on the entire header value. The commit diff shows this was replaced with a simple indexOf/trim operation to avoid regex processing. This matches the ReDoS vulnerability pattern where complex regex operations on untrusted input create denial-of-service risks. The patch specifically addresses this by eliminating the vulnerable regex split.