The vulnerability stems from decompressors not enforcing size/count limits. The patch added FileSizeLimit and FilesLimit fields to all decompressor structs and passed them to untar/copyReader functions. Vulnerable versions used default Decompressors map created via init() with new() constructors that didn't set these limits, making their Decompress methods process input without resource constraints. The affected functions are the Decompress methods of all compression-type specific decompressors that handle archive processing.