The vulnerability stems from improper handling of HTTP redirects in System.Net.Http, specifically exposing authentication headers during cross-domain redirections. The RedirectHandler.SendAsync method is central to redirect logic in .NET Core's HTTP stack. Since the advisory explicitly mentions redirect-related information disclosure and System.Net.Http is the affected package, the redirect handling mechanism (particularly header propagation logic) is the most likely culprit. The confidence is high because this aligns with the described vulnerability pattern and the component's responsibility.