A specially crafted URL can cause a denial of service via the transliterate mechanism.
https://www.drupal.org/SA-CORE-2016-005