The vulnerability stems from how headers were processed in AjpProcessor.prepareResponse(). The pre-patch code used a single-pass for-loop that: 1) Only generated SEND_HEADERS during the first iteration 2) Could exit without sending headers if all were removed via error handling 3) Didn't account for zero-header responses. The commit introduced retry logic (while-loop with header regeneration) to ensure at least one SEND_HEADERS is always sent, confirming the original function's flawed control flow was the root cause.