The vulnerability description explicitly states the server overrides maximum websocket message size limits. This strongly suggests the websocket handler initialization function (commonly named init or similar) contains the vulnerable configuration. The lack of size restriction would be implemented at the websocket handler level, making this the most logical location. While exact code isn't available, the pattern matches common websocket implementations where max_size parameters control message limits.