Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory.