The vulnerability stems from the lack of an allowlist during deserialization in multiple network-facing components. While specific function names and file paths aren't provided in the available data, the CVE description explicitly identifies the affected components (discovery SPI, Memcached, etc.) as deserialization endpoints. These components inherently require deserialization logic to process incoming data, and the absence of an allowlist in versions <2.4 makes their deserialization entry points inherently vulnerable. This aligns with CWE-502 patterns where untrusted data is deserialized without proper validation.