The vulnerability stems from two key issues in server.py: 1) Missing socket timeout configuration during socket creation (no socket.setdefaulttimeout(10)), allowing accept() to block indefinitely. 2) Lack of explicit handling for socket.timeout exceptions in the accept() loop, preventing recovery from hung connections. The commit 3a7b880 explicitly addresses both by adding the timeout configuration and exception handling, confirming these were the vulnerable points. The serve() method's accept() loop is the critical path where resource exhaustion occurs.