The vulnerability stems from WEBrick's failure to reject requests containing both Content-Length and Transfer-Encoding headers. The commit f5faca9 explicitly adds a check in the read_body method to detect this condition and raise an error. The pre-patch version of read_body in httprequest.rb lacked this validation, making it the vulnerable function. The test case in test_httprequest.rb confirms the exploit scenario targets this function's behavior.