The vulnerability stemmed from unconfigured XML parsers allowing unlimited entity expansion. The patches show critical replacements of DocumentBuilder.parse() calls with secure buildDOM() methods that enforce entity limits. The TikaConfig constructors were directly modified to remove vulnerable parsing methods, indicating these entry points previously used insecure configurations. XMLReaderUtils.getDocumentBuilder() is identified as the source of unsecured DocumentBuilder instances before the patch added entity limit controls.