The vulnerability explicitly relates to audit logging with emit_request_body enabled. These functions are core components of Elasticsearch's audit logging system that would handle request body inclusion. The CWE-532 classification confirms this is a logging-sensitive-data issue. While exact code isn't available, Elasticsearch's architecture documentation and security advisories indicate these components manage request body logging. The patched versions likely added filtering in these functions.