The GitHub patch shows critical regex pattern changes in httprequest.rb:

1. Transfer-Encoding header check was tightened from /chunked/ to /\Achunked\z/
2. Connection header checks were anchored with \A and \z. These lax regex patterns in the original code allowed attackers to craft malicious headers that would be interpreted differently by WEBrick and reverse proxies, enabling request smuggling. The functions handling these header validations are directly implicated in the CVE description and patch changes.