The vulnerability stems from 4 functions that:

1. Create a Vec buffer with capacity
2. Use unsafe { set_len } to expand without initialization
3. Pass the uninitialized buffer to Read::read_exact

This violates Rust's safety requirements as Read implementations expect initialized buffers. The advisory explicitly lists these functions, and code examples confirm the unsafe pattern. The GitHub issue #2 provides direct evidence of the vulnerable code patterns in deserialize_binary/string, and the advisory extends this to include deserialize_extension_others and deserialize_string_primitive with the same vulnerability pattern.