The vulnerability stems from an off-by-one error in parameter counting logic. The commit diff shows the fix moved 'parameterCount++' after the limit check and changed the condition to 'parameterCount >= limit'. In the original code, incrementing before checking meant that when exactly maxParameterCount parameters were sent, the count would reach limit+1 only after processing, failing to trigger the protection. This allowed bypassing uploaded parts limits via precisely maxParameterCount query parameters.