The vulnerability exists due to inconsistent parsing of HTTP request line and header terminators in the WEBrick library. The core of the issue lies in the fact that WEBrick was more lenient than many proxy servers, accepting a lone Line Feed (LF) as a terminator in addition to the standard Carriage Return Line Feed (CRLF). An attacker could exploit this by crafting a request where the proxy server sees one request (ending in CRLF) while WEBrick, processing the same byte stream, sees two separate requests because it treats a subsequent LF as a delimiter.

The patch addresses this by enforcing stricter adherence to RFC standards. The key changes are in WEBrick::HTTPRequest#read_header and WEBrick::HTTPRequest#read_request_line, where the regular expressions are modified to exclusively accept CRLF (\r\n) as the line terminator. Additionally, WEBrick::HTTPUtils.parse_header was updated to prevent forbidden characters (CR, LF, NUL) within header values. These functions are the direct runtime indicators of the vulnerability, as they are responsible for the initial parsing of the malicious, smuggled HTTP request.