The vulnerability stems from improper hostname normalization when checking deny lists. The commit diff shows critical changes in hostname handling:

1. In BuildProxy, switching from req.Host to req.URL.Hostname() for remoteHost determination
2. In handleConnect, changing from pctx.Req.Host to pctx.Req.URL.Hostname() for security checks These functions were vulnerable because req.Host preserves square brackets around hostnames, while URL.Hostname() properly strips them. The original implementation allowed attackers to bypass deny lists by wrapping domains in square brackets, as the deny list matching would see '[example.com]' instead of 'example.com'.