The vulnerability stemmed from three key elements:

1. cleanEntities' entityRegex contained multiple unbounded quantifiers (\s*, \S*) that could be exploited with long whitespace/entity declarations
2. removeDtdMarkupDeclarations' regex used nested quantifiers ([A-Z]+ and [^>]*) vulnerable to polynomial backtracking
3. The main validation regex combined these patterns with other complex constructs. The commit patched this by replacing regex-based validation with a proper XML parser, confirming these functions were the attack surface. PoC examples specifically demonstrate exploitation of these regex patterns.