The issue is related to the mishandling of the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials because they may appear in SNI data or HTTP headers. This can enable a remote attacker to access confidential data.