The vulnerability stemmed from improper DER encoding validation. The commit diff shows critical additions to remove_integer (checks for zero-padding in integers) and read_length (minimal length encoding validation). These functions directly handled DER parsing but lacked strict encoding rules enforcement pre-patch. The added tests in test_der.py explicitly target these failure modes, confirming their role in the vulnerability.